0xray 3.0.11 → 3.0.14

package/dist/CHANGELOG.md

@@ -4,437 +4,53 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
-## [3.0.11] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.10] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.9] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.8] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.7] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.6] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.5] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.4] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.4] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.3] - 2026-06-13
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.2] - 2026-06-12
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.1] - 2026-06-12
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [3.0.0] - 2026-06-12
-
-### 🧠 Governance Closure + Full System Integration
-
-v3.0 closes the governance loop: all enforcement flows through the shared gate, governance is enabled by default with external Dynamo, and source changes to the governance fabric are auto-detected and proposed for deliberation.
-
-### 🌟 Highlights
-
-- **Governance default-on**: `enabled: true` in both `DEFAULT_GOVERNANCE_CONFIG` and `xray/features.json`. Endpoint defaults to `https://mcp-production-80e2.up.railway.app/governance`. `GOVERNANCE_ENDPOINT` env var overrides all defaults. No manual opt-in required.
-- **E2E pipeline smoketest extended to 10 steps**: gate → escalation → CI → consumer → governance → nucleus → inference → SelfProposal → EscalationEngine → LightweightValidator. All 10 pass.
-- **Source-change governance detector**: `scripts/ci/source-change-governance-detector.mjs` watches codex.json, features.json, enforcement/nucleus/postprocessor/governance files. Auto-submits strategic proposals via `handleGovernRequest` with `requireExternalDynamo: true`. Wired in CI enforcement job.
-- **Consumer path hygiene audit**: All published scripts (`postinstall.cjs`, `setup.cjs`, `prepare-consumer.cjs`) now use robust consumer-aware path resolution. Nucleus exports map (`./nucleus/*`) verified via consumer plugin test.
-
-### 🏪 Marketplace & Polish
-
-- **Marketplace PR #23** submitted to `xai-org/plugin-marketplace` — 13 xray-skills tools, 44 skills, 2 MCP servers
-- **xray-skills MCP server**: 13 tools via `npx -y 0xray mcp skills` — standalone, zero config
-- **Railway governance HTTP MCP**: multi-client session support, JSON response mode, GET `/mcp` SSE endpoint
-- **`.mcp.json`**: xray-skills (public) + xray-governance (advanced) declared
-- **`.plugin/plugin.json`**: Marketplace manifest with correct tool/skill counts
-- **skills/ symlink** → `src/skills/` for marketplace scanner discovery
-
-### 🔧 Changes
-
-#### Governance & Enforcement (Phases 0-1)
-- **Retro governance ritual (Phase 0)**: 5 proposals submitted via `handleGovernRequest` covering enforcement gate canonical surface, per-pipeline CI scanners, nucleus/SelfProposal wiring, legacy purge, consumer hooks. All 5 approved.
-- **Governance lazy init**: `governance-service.ts` calls `initializeGovernanceIntegration()` in `govern()` if not initialized — handles inference cycle calls outside boot orchestrator lifecycle.
-- **Governance endpoint default-on**: `src/integrations/governance/types.ts` — `DEFAULT_GOVERNANCE_CONFIG.enabled → true`, `endpointUrl → Railway URL`. `xray/features.json` added `inference_governance` section.
-- **Source-change detector (Phase 1)**: `scripts/ci/source-change-governance-detector.mjs` — detects changes to 18+ governance-interest files, builds proposals from CATEGORY_MAP, requires external Dynamo. Wired in `ci.yml` enforcement job step.
-
-#### Docs Cascade (Phase 2)
-- `V3-ENFORCEMENT-PIPELINES.md` → v3.3.1+ (full enforcement cascade documented)
-- `PIPELINE_INVENTORY.md` → v3.3.1+ (new CI scanners, consumer hooks, coverage gate, governance detector)
-- `docs/index.md` → v3 stats (7 agents, 3 MCP servers, 29 validators, 2880 tests)
-
-#### Pipeline Exerciser (Phase 3)
-- `e2e-pipeline-smoke.mjs` extended from 4 to 10 steps covering all major pipelines (gate, escalation, CI, consumer, governance, nucleus/boot, inference, SelfProposal, EscalationEngine, LightweightValidator). All 10 pass.
-- EscalationEngine must load before LightweightValidator (ESM circular dep on frameworkLogger).
-
-#### Codex Closure (Phase 4)
-- `processorRoadmap` terms 7 (ErrorResolution), 74 (BootWiring), 75 (Coverage) → done
-- `validationCriteria`: 6/8 true (governance approval, metamorphosis threshold, consumer verification, no console.*, boot wiring, coverage gate)
-- `perPipelineValidationMatrix`: 15+ entries, `gapsRemaining` empty, `enforcementGaps` 2 remaining
-- Terms 73 (orphan pre-PR check), 78 (compat shim scanner) added with CI wiring
-
-#### Build & Consumer Hygiene (Phase 5)
-- `package.json` exports: added `./nucleus` and `./nucleus/*` for consumer plugin-registry access
-- `tsconfig.full.json`: excludes test files from compilation
-- `postinstall.cjs`, `setup.cjs`, `prepare-consumer.cjs`: consumer-aware path resolution (robust `node_modules` detection)
-- `verify-consumer.sh`: Phase 5b (29 validators + gate) + nucleus plugin-registry test both PASS
-- Full verification: 2880 unit tests pass, typecheck clean, 0 console.* in non-CLI source
-
-#### Compat & Scanners
-- `scripts/ci/compat-shim-scanner.mjs` (term 78): scans for legacy fallback patterns, compat exports, @deprecated. Wired as non-blocking CI step.
-- `scripts/ci/orphan-code-pre-pr-check.mjs` (term 73): git diff deletion scanner with 6-check protocol. Wired in CI.
-- `scripts/hooks/install-hooks.cjs`: consumer-aware pre-commit hook installer, wired via postinstall + setup.
-- `scripts/hooks/run-hook.js`: inline regex replaced with LightweightValidator + gate call (shared enforcement path).
-
-### 📊 Stats
-- **2880 tests pass**, typecheck clean
-- **29 validators** in registry, all mapped in `validatorTermMap`
-- **10/10 E2E pipeline steps** pass
-- **3/4 bridge E2Es** pass (hermes: pre-existing model variance in JSON output parsing)
-- **18 governance-interest files** tracked by source-change detector
-- **Consumer verification**: Phase 5 (plugin reg) + Phase 5b (29 validators + gate) both PASS
-
-## [3.3.0] - 2026-06-11
-
-### ✅ All Three Remaining Matrix Gaps Closed
-
-Resolved the final `gapsRemaining` entries — PostProcessor non-blocking, Inference non-blocking, and Coverage gate.
-
-- **PostProcessor escalation from gate**: `afterToolHook` in enforcement-gate.ts now filters pipeline validator violations by severity ("error"/"blocking") and passes them as `criticalViolations` in the PostProcessor context. `PostProcessor.executePostProcessorLoop` evaluates them through `EscalationEngine.evaluateEscalation`, triggering real escalation (manual-intervention/rollback/emergency) instead of logs-only.
-- **Inference 1/3/5 blocking**: `generateProposals` in inference-cycle.ts now filters out proposals with confidence ≤ 0.3 after NoOverEngineeringValidator (terms 1/3) and SingleResponsibilityValidator (term 5) adjustments. These proposals are logged as `proposal-blocked` via frameworkLogger. Non-severe violations still adjust confidence by 0.85x as before.
-- **Coverage gate (term 75)**: vitest.config.ts now has coverage thresholds (statements 60%, branches 50%, functions 55%, lines 60%). CI enforcement job runs `npx vitest run --coverage` as a blocking step. Fails CI if thresholds not met.
-
-### 🔧 Changes
-- `src/postprocessor/types.ts`: Added `criticalViolations` field to `PostProcessorContext`
-- `src/postprocessor/PostProcessor.ts`: Escalation engine invoked on gate-sourced critical violations
-- `src/integrations/enforcement-gate.ts`: Critical violations passed to PostProcessor loop context
-- `src/inference/inference-cycle.ts`: Proposals with confidence ≤ 0.3 filtered out after validator adjustments
-- `vitest.config.ts`: Coverage thresholds enabled (stmts 60, branches 50, funcs 55, lines 60)
-- `.github/workflows/ci.yml`: New coverage gate step in enforcement job
-- `.opencode/xray/codex.json`: 3.3.0 — all 3 gaps removed from `gapsRemaining` + `enforcementGaps`. New `coverage-gate` pipeline entry. Post-processor + inference-cycle entries updated to note blocking/escalation. `ci-gate` activeForTerms includes 75.
-
-## [3.2.1] - 2026-06-11
-
-### 🚦 Enforcement Pipeline Cascade
-
-Closing the "hooks or CI/CD" gap: all four TUI/CLI integrations (OpenCode, Hermes, Grok, OpenClaw) now exclusively route through `src/integrations/enforcement-gate.ts` (full 29-validator registry + v3 PostProcessor loop), and CI now calls the registry directly with no snippet-safe filter.
-
-- **P0-1**: Removed duplicate legacy ProcessorManager block from `xray-codex-injection.ts` (38 lines, ran afterToolHook alongside inline quality gate)
-- **P0-2**: Fixed Grok silent fail-open — catch block now returns `allow_with_error` with reason/resonance/error
-- **P1-1/P1-2**: Consolidated `loadStateManager` to prefer `xray*` globals with logged `strRay*` fallback; `bridge.mjs` renamed to `XrayStateManager` with `||` fallback
-- **P1-3/P1-4**: Removed dead types/interfaces/imports from `xray-codex-injection.ts`; shrunk legacy compat comment
-- **`scripts/ci/enforce-validators.mjs`**: Direct ValidatorRegistry invocation (29 validators, no snippet-safe filter, no dead `--terms` flag). Supports `--all`, explicit paths, `git diff HEAD` auto-detection
-- **CI enforcement job**: Replaced `bridge.mjs codex-check --focus "full" --terms "..."` (10 of 29 validators) with `enforce-validators.mjs --all`
-- **CI consumer step**: `npm pack` → `npm install` → registry load test (expects 29) + enforcement gate load test (beforeToolHook/afterToolHook) — runs on every PR
-- **`verify-consumer.sh` Phase 5b**: Full-registry + gate exercise from consumer tarball
-- **Codex**: v3.2.1 — 8 ci-lint terms partial→wired, new `ci-enforce-consumer` pipeline, `gapsRemaining` reduced by 2 entries
-
-### 🔧 Changes
-- `src/plugin/xray-codex-injection.ts`: beforeToolHook/afterToolHook sole post-tool path
-- `src/integrations/hermes-agent/bridge.mjs`: `XrayStateManager` with backward-compat fallback
-- `src/integrations/grok/hooks/pre-tool-use.ts`: `allow_with_error` on gate error
-- `src/integrations/enforcement-gate.ts`: `loadStateManager` prefers `xray*` globals
-- `scripts/ci/enforce-validators.mjs`: 109 lines — new
-- `.github/workflows/ci.yml`: Enforcement job reworked (registry + consumer steps)
-- `.opencode/xray/codex.json`: 3.2.1 — perPipelineValidationMatrix expanded, gaps reduced
-- `docs/reflections/enforcement-gate-pipeline-resolution.md`: Updated
-
-## [3.0.0] - 2026-06-10
-
-### 🚀 Major: Nucleus Architecture (v3)
-
-The callable core is now `src/nucleus/` — governance, orchestration, dispatch, and default plugins live here. MCP is the standard external surface; nucleus is the library beneath it.
-
-- **Phase 1 (Nucleus Primary)**: Governance call site audit (29 sites), MCP fallback chain removed from inference-cycle.ts (287 lines, 9 methods, 7 `XRAY_FORCE_MCP_GOVERNANCE` checks), opencode-cli-invoker.ts cleaned, boot-orchestrator.server.ts slimmed ~80%, `src/nucleus/orchestrator.ts` + `thin-dispatch.ts` created, 50 nucleus-primary tests
-- **Phase 2 (Plugin System)**: 24 knowledge-skill servers audited, pluginRegistry extended with listTools/registerServer/getToolPlugin/listSkillTools, `src/nucleus/default-plugins.ts` registers all 24 servers as plugins, MCP bypass paths deprecated, root MCP server audit
-- **Phase 3 (Self-Evolution)**: SelfProposalEngine auto-wired into PostProcessor as default metamorphosis engine, safe apply with backup/rollback, circuit breaker, `scripts/run-self-evolution.sh`
-- **Phase 4 (Legacy Cleanup)**: `XRAY_FORCE_MCP_GOVERNANCE` removed from CLI/govern/.mcp.json/grok-cli, MCP+in-process fallback removed from governance-service, legacy `.grok/plugins/strray-ai/` deleted, `STRRAY_HOME` removed
-
-### 🔧 Changes
-- `registerDefaultPlugins()` now called during NucleusOrchestrator boot sequence (plugin-registration step)
-- FrameworkLogger discipline enforced across all production paths
-- ~17,000 LOC net removed across subtract pass + v3 refactoring
-
-### ✅ Verification
-- 2846 tests passed (2890 total, 44 skipped), 163 test files — 0 failures
-- Consumer verification gate: 4/4 bridge E2Es (Hermes 46, OpenCode 34, OpenClaw 101, Grok 53+2 skipped)
-- npm pack → fresh consumer install → plugin dispatch → activity.log (728 entries)
-- tsc --noEmit clean
-
-### 🏷️ Package
-- Renamed: `strray-ai` → `0xray` across all source files, CLI, bridges, docs
-- Published to npm as `0xray@3.0.0`
-
----
-
-## [2.2.4] - 2026-06-10
-
-### 🐛 Bug Fixes
-- fix: Dynamo SSOT local-mode for inference cycles (requireExternalDynamo: !XRAY_LOCAL_MODE to prevent silent needs_revision fallback in dev/CI) (5e0746665)
-- ci: add verify:consumer as hard gate in release.yml before GitHub release (5e0746665)
-- fix: routing cleanup — dedup availableServers list, correct research/explore mapping to "researcher" skill directly (prior + 5e0746665)
-- fix: release.mjs publish timeout handling (npm view check for "already published") and step order (push before publish) (b444b6ac8, b1f9c6cdd)
-
-### 🔄 Changes
-- Scope 2.2.4 to the 5 blocking items only (Dynamo, CI gate, routing hygiene). All Phase 1-4 deferred to v3 per v3-architecture-plan.md.
-
----
-
-## [2.2.3] - 2026-06-10
+## [3.0.14] - 2026-06-14
 
 ### 🔄 Changes
 
 ### 🐛 Bug Fixes
-- fix: make hermes E2E tolerant to model response variance; soft-fail Phase 3/6, keep hard gates on bridge + activity.log (a290fb9ec)
-- fix: sync README counts (41 agents, 44 skills, 15 MCPs, 68 codex terms, 160 tfiles); version-manager now auto-counts codex + tests (a783dc2e6)
-
----
-
-## [2.2.2] - 2026-06-10
-
-### 🔄 Changes
-
-### 🐛 Bug Fixes
-- fix: make hermes E2E tolerant to model response variance; soft-fail Phase 3/6, keep hard gates on bridge + activity.log (a290fb9ec)
-- fix: sync README counts (41 agents, 44 skills, 15 MCPs, 68 codex terms, 160 tfiles); version-manager now auto-counts codex + tests (a783dc2e6)
-
----
-
-## [2.2.2] - 2026-06-10
-
-### 🔄 Changes
-
-### 🐛 Bug Fixes
-- fix: sync README counts (41 agents, 44 skills, 15 MCPs, 68 codex terms, 160 tfiles); version-manager now auto-counts codex + tests (a783dc2e6)
-
----
-
-## [2.2.2] - 2026-06-10
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [2.2.2] - 2026-06-10
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [2.2.2] - 2026-06-10
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [2.2.2] - 2026-06-10
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [2.2.1] - 2026-06-10
-
-### 🔄 Changes
-
-- Version bump
-
----
-
-## [2.2.0] - 2026-06-10
-
-### 🚀 Features
-- feat: add Codex terms 69-72 covering self-evolution constraints (proposal governance, metamorphosis threshold, safety controls, traceability) (codex.json)
-- feat: long-running governed agent session verification E2E (11 tests, self-evolution-e2e.test.ts)
-- feat: Plugin API documentation — SkillPlugin, MetamorphosisEngine, SelfProposalEngine interfaces (docs/api/plugin-api.md)
-- feat: SelfProposalEngine with unit + E2E tests (postprocessor/metamorphosis/SelfProposalEngine.ts)
-- feat: nucleus kernel facade — handleGovernRequest, governViaNucleus, pluginRegistry (src/nucleus/)
-- feat: CLI govern command — status, audit, proposals, MCP management, storyteller (src/cli/commands/govern.ts)
-- feat: consumer verification script (scripts/verify-consumer.sh)
-
-### ♻️ Refactoring
-- refactor: 12-review subtract pass across all subsystems — ~16k LOC removed (Core, Nucleus, Governance, MCP, Inference, Orchestration, Delegation, Processors, Postprocessor, Enforcement, Integrations, CLI, Supporting)
-- refactor: delete trace-context.ts, errors.ts, logging-config.ts (inlined into framework-logger)
-- refactor: delete applyDecisionMatrix dead PHI/TAU matrix from governance-core
-- refactor: delete testing-best-practices.server.ts (1,183 LOC unregistered MCP bloat), orchestrator.server.ts shim
-- refactor: delete 4 dead orchestrator/delegation files (universal-registry-bridge, universal-librarian-consultation, self-direction-activation, task-skill-router.d.ts)
-- refactor: delete RetryHandler.ts, ComprehensiveValidator.ts from postprocessor
-- refactor: delete test-auto-healing.ts, cross-language-bridge.ts
-- refactor: delete 5 CLI dead files (4 analytics commands, server.ts)
-- refactor: delete 19 dead source + 6 stale test files across analytics, infrastructure, performance, reporting, utils, validation, state
-- refactor: delete dead expertise barrel exports (getAgentsWithExpertiseDomain, getTopExpertsForDomain)
-- refactor: update Codex references from 68 to 72 terms across docs
-- refactor: clean dead test script references in package.json
-
-### 🐛 Bug Fixes
-- fix: repair syntax from STRRAY_ cleanup (setup.ts, hermes bridge) so tests and release guard pass (87f3613ad)
-- fix: E2E test references to applyDecisionMatrix updated to mergeVotes
-
----
-
-## [2.1.4] - 2026-06-09
-
-### 🔄 Changes
-
-### 🐛 Bug Fixes
-- fix: repair syntax from STRRAY_ cleanup (setup.ts, hermes bridge) so tests and release guard pass (87f3613ad)
-
-### 🔎 Other Changes
-- chore(release): strip remaining legacy STRRAY_ env fallbacks & shims so prepublish guard passes for v2.1.3 (0038993fc)
-
----
-
-## [2.1.3] - 2026-06-09
-
-### 🔄 Changes
-
-### 🐛 Bug Fixes
-- fix: normalize PostProcessor and related log keys/IDs to clean frameworkLogger pattern (postprocessor/*, no leading -, no strray remnants); aligns with codex/AGENTS 'frameworkLogger structured logging ONLY' (742a207da)
-- fix: add missing frameworkLogger imports to seo-consultant and tech-writer (post previous console fixes) (af8f7dc86)
-- fix: replace remaining console.error with frameworkLogger in MCP run catches for Codex compliance (6 + 3 no-catch cases) (cdabdeb15)
-
-### ♻️ Refactoring
-- refactor: wire security-audit CLI, port encryption into security-hardener, delete 5 orphaned files (1c9f41ef5)
-
-### 🧪 Tests
-- test: add openclaw e2e Phase 13 for agent tool event → frameworkLogger → activity.log (c4e30e853)
-
-### 🔧 Maintenance
-- chore: final post-fix normalization and verification pass (MCP, security, PostProcessor, logs) - all tests green, no regressions (8262754fe)
-- chore: ensure clean state post-subtract fixes and push verification (a16557a6a)
+- fix: grok plugin dir naming, broken symlink, stale validate script refs (7bbee499c)
+- fix: update integrations-e2e test for XrayAPIServer rename (b68eeb845)
+- fix: exports map, openclaw XrayAPIServer rename, validator count 29→28 (035ba4986)
+- fix: rename StringRay* class names to Xray* across server files and update strray-codex- internal IDs (ec1182bfb)
 
 ### 🔎 Other Changes
-- docs(reflection): 4-plugin isolated npm-pack + tmp-dir + per-plugin npx install + e2e + subagent + log-monitor verification (grok/hermes/opencode/openclaw) (982aa8434)
-- subtract/simplify phase: MCP base class (39 servers) + fixes (console->frameworkLogger, stale refs in boot/test/package), security consolidation, PostProcessor decomposition, reflection update (0bd3b07a0)
-- v2.1.3 subtract & simplify phase (cdaefe2ed)
-
----
-
-## [2.1.1] - 2026-06-08
-
-### 🔄 Changes
-
-### 🐛 Bug Fixes
-- fix: sweep remaining .strray → .xray references in source files (12b992206)
-- fix: pre-publish-guard handles missing features.json, release.mjs uses --ignore-scripts (cd65f6309)
+- v3.0.13 release fixes: main/types, files cleanup, testing-best-practices registration, e2e guards (c26e1ec28)
+- v3.0.13 release: rename, test fixes, E2E postinstall config tests (177fa12c5)
 
 ---
 
-## [2.0.1] - 2026-06-08
+## [3.0.13] - 2026-06-14
 
-### 🔄 Changes
+### 🚀 Major Release — v3 MCP-Centric Pure v2 Three-Subsystem
 
-### 🐛 Bug Fixes
-- fix: purge stale strray refs in plugin — logger names, lock file, log path, codex IDs, fallback paths (8eed78b97)
-- fix: rename strrayCodexPlugin→xrayCodexPlugin in source (8f7bba7ca)
-- fix: plugin status in init.sh — check dist/plugin/ for dev mode, not just .opencode/plugin/ (81a50096d)
-- fix: update init.sh for v2.0.0 — fix version detection (0xray not strray-ai), update paths, stats, naming (f73840e94)
-- fix: add prepare script for auto-build on git install, fix console.error→frameworkLogger in multimodal-looker (9f159fcea)
-- fix: resolve all broken docs links — README→full-reference, case mismatches, nesting errors, missing docs/index.md (32b2de880)
-- fix: replace favicon.jpg with proper PNG favicon (64x64) (ed34aa2b2)
-- fix: add real 0xRay logo and favicon for Docusaurus navbar + static landing page (cae124470)
-- fix: landing page 404s — rename README.md→full-reference.md, create agents/README.md, fix 3 broken links in static/index.html (README, mcp/overview, agents), update sidebar id (1e3d9ec93)
-- fix: docusaurus internal links — relative paths missing /xray/ base, broken LICENSE ref (5caeb107b)
-- fix: deploy-docs trigger branch master → main (167542f03)
-- fix: docusaurus org URL — 0xray → 0xRayAI (07d7d0dc4)
+#### 🔄 Rename: `strray-ai` → `0xray`
+- Renamed across 60+ source files, CLI help text, grok plugin, hermes-agent bridge (Python + JS), docusaurus config
+- Updated `.gitignore`, `.npmignore`, package name to `0xray`
+- Hermes-agent bridge backward compat: all JS/Python bridge files check for both `strray-ai` (old) and `0xray` (new)
 
-### 📚 Documentation
-- docs: add Dynamo Governance link (https://dynamo.rippel.ai/vortex) to README, introduction, and full-reference (c3d9846b7)
-- docs: add link to docs site (https://0xrayai.github.io/xray/) in README, introduction, and full-reference (3919376ec)
+#### 🧠 MCP-Centric Architecture
+- Centered on **MCP (Model Context Protocol)** as the primary surface for agent skills
+- Three agent MCP servers: `code-review`, `security-audit`, `researcher`
+- YML agent declarations in `.opencode/agents/*.yml` — zero manual setup
+- thinDispatch 7-flow routing in MCP orchestrator for autonomous engine
 
-### 🔎 Other Changes
-- v2.0.0: port full docusaurus doc tree from stringray — architecture, agents, MCP, security, testing, guides, operations; batch branding update (strray-ai → 0xray, StringRay → 0xRay); update versions/counts; rebuild sidebar (10c9e7bb7)
-- v2.0.0: rewrite README for end users — value proposition, platform install, full CLI reference, features.json, governance config, 42-agent inventory, docusaurus alignment (fb01855e1)
-- v2.0.0: expand CHANGELOG with full release scope (e1fd84ceb)
-- v2.0.0: hermes bridge processor logging fix, E2E script updates (strray-ai → 0xray) (149ea06c6)
+#### 🛠️ Build & Test Hardening
+- **Build fix**: removed stale `.opencode/plugin/xray-codex-injection.js` copy that broke due to relative imports
+- `package.json` canonical reference: `"opencode"."plugin": "./dist/plugin/xray-codex-injection.js"`
+- **Fixed 8 failing test files**: class name references, missing exports, source-inspection, monkey-patch for tool extraction
+- **Full suite**: 182 test files, 3113 tests, 0 failures
+- **E2E**: 25 tests passing across 4 consumer platforms
 
----
+#### 🧹 Technical Debt
+- Cleaned AGENTS.md + README.md: rewritten v2 MCP-centric
+- Dead docs git-rm'd: 12 stale doc files
+- Cleaned `.gitignore` stale `.strray/` entries
+- CLI help text: removed dead `dashboard` command
 
 ## [2.0.0] - 2026-06-05
 
-### 🚀 Major Release — Pure v2 MCP-Centric Three-Subsystem Architecture
-
-Published as `0xray` on npm — first release under the 0xRayAI org. 2,863 tests, 0 unit failures, 0 npm vulns.
+### 🚀 Major Release — Pure v2 Three-Subsystem Architecture
 
 #### 🧠 Three-Subsystem Architecture (Wired & Complete)
 - feat: extract and wire CodexPolicyService as Governance SSOT for codex reads (enforcer-tools.server.ts, governance.server.ts)
@@ -442,73 +58,24 @@ Published as `0xray` on npm — first release under the 0xRayAI org. 2,863 tests
 - feat: wire ProposalApplier via callback pattern into inference-cycle (git/PR execution)
 - feat: add handleGetActiveCodex MCP tool to governance server (delegates to CodexPolicyService)
 - feat: add strray/codex.json to resolveCodexPath() fallback candidates
-- feat: 3 dedicated governance MCP servers (code-review, security-audit, researcher) deliberate proposals
-
-#### 🏷️ Package Rename: strray-ai → 0xray
-- feat: rename package `strray-ai` → `0xray` across 60+ source files, CLI help text, grok plugin, hermes-agent bridge (Python + JS), docusaurus config, package.json
-- feat: rename root config dir `strray/` → `xray/` — 19 files updated, MCP server names, build script, .opencode paths
-- feat: backward compat maintained — all bridge files check both `strray-ai` (old) and `0xray` (new)
-- feat: `.npmignore` fixed (removed `src/` entry that conflicted with `files` field)
-- feat: `.gitignore` cleaned — stale `.strray/` entries, `strray-ai-*.tgz` → `0xray-*.tgz`
-- feat: `package.json` files field expanded — added `src/skills/` and `src/mcps/` directories
 
 #### 🛡️ Governance Pipeline Hardening
 - feat: add end-to-end timeout (default 90s) to govern() with AbortController
 - feat: add configurable timeoutMs and maxAbstentionThreshold to GovernOptions
 - feat: add 30s timeout wrapper for callInProcessSkill() (Vercel/serverless path)
-- feat: Dynamo governance endpoint configurable via `GOVERNANCE_ENDPOINT` env var (no longer hardcoded)
-- feat: governance MCP HTTP auth — `x-api-key` header against `GOVERNANCE_API_KEY` env var
-- fix: governance-service `overallDecision` now returns `'reject'` when appropriate; ProposalType mapping fixed
-- fix: governance-service `as any` → `MCPToolResult` type
-
-#### 🔒 Security Hardening (3 Critical, 6 High)
-- C1: `proposal-applier.ts` — `execSync()` → `spawnSync()` with args arrays, `sanitizeGitArgument()` strict regex
-- C2: `plugin-commands.ts` — plugin name validation, `execSync` → `spawnSync`, `validateManifest()` shell metacharacter rejection
-- C3: `governance-client.ts` + `types.ts` — hardcoded URL → `GOVERNANCE_ENDPOINT` env var
-- H1: `process-spawner.ts` — env whitelist (PATH, HOME, NODE_PATH, TMPDIR, etc.) prevents secret leakage
-- fix: npm audit: 11 vulns → 0
-
-#### 📄 Documentation Rewrite
-- feat: AGENTS.md rewritten v2 MCP-centric, updated codex path, session summary appended
-- feat: README.md v2.0.0 rewrite with MCP hero, GitHub `0xRayAI/xray`, npm `0xray`
-- feat: Docusaurus updated — org URL `0xRayAI/xray`, npm `0xray`, edit URL fixed
-- feat: CLAUDE.md created for both master and v2, references 68 codex terms
-- chore: 12 stale docs git-rm'd: AGENTS-consumer.md, AGENTS-full.md, CHANGELOG-v1.15.x.md, 7 docs/ files
-
-#### 📏 Codex Expansion (61→68)
-- feat: codex rules 61-68 added to both `xray/codex.json` (v2) and `.strray/codex.json` (v1)
-  - 61: Do One Thing, 62: Triage-Fix-Loop, 63: Watch Errors, 64: Always Add .gitignore
-  - 65: Write Tests, 66: Modular E2E Tests, 67: Use Best Subagents, 68: Lead Dev Mindset
-- feat: CodexPolicyService — 13 new tests (getTermCount, getCurrentCodex, fallbacks)
-
-#### 🐛 Hermes Bridge Processor Logging Fix
-- fix: root cause — `executePreProcessors()` returns `{ success, results: [...] }` while `executePostProcessors()` returns `[...]`; `Array.isArray` check failed for pre-processors → processorCount always 0
-- fix: normalized return format with `Array.isArray(rawResults) ? rawResults : (rawResults.results || [])`
-- fix: added `[pre-processors]`, `[post-processors]`, `[pre-processor]`, `[post-processor]` log entries
-- fix: deployed updated bridge.mjs/__init__.py/schemas.py/tools.py to `~/.hermes/plugins/strray-hermes/`
-
-#### 🧹 Code Quality
-- fix: removed duplicate `program.command('plugin')` — CLI was broken, now works
-- fix: removed dead Python path checks from boot-orchestrator.server.ts and framework-compliance-audit.server.ts
-- fix: `process.stderr.write` → `frameworkLogger` in 3 files (governance.server.ts, skill-invocation.server.ts, shutdown-handler.ts)
-- fix: 58 `substr()` → `substring()` across codebase
-- fix: removed 4 dead dynamic imports in CLI index.ts
-- fix: renumbered help text steps consecutively
-- fix: JSON.stringify wrapped in try/catch in framework-logger.ts
-- fix: `any` type in governance-types.ts → proper CodexSnapshot interface
-- fix: MCP server deep review — researcher SKILL.md path, security-audit SKILL.md tool list, governance.server.ts logging, duplicate imports, 9 malformed log keys fixed
+
+#### 🧹 Cleanup
+- chore: remove aside-context.ts (160 lines, zero consumers — dead code)
+- chore: update repo URLs to github.com/0xRayAI/xray
+- chore: bump version to 2.0.0
 
 #### ✅ Test Coverage
-- 161 test files, 2,863 tests, 0 unit failures, build passes, 0 npm vulns
-- 41 new tests: codex-validators dynamic read (68 terms), governance-service (22), codex-policy.service (13), mcp-server-smoke (5), mcp-servers-integration (16 behavioral)
-- Full consumer E2E gate: Hermes 46/0/0, OpenCode 34/0/0, OpenClaw 96/0/0, Grok CLI 55/0/2 — 0 failures across 231 tests
+- 158 test files passing, 2822 tests, 0 failures
+- 20 new tests for three-subsystem wiring (enforcer-tools, cli-invoker, proposal-applier)
+- Fixed 9 failing test files (codex-validators, governance-client, mcp-servers-integration, inference-governance-integration, session-capture, integrations-e2e, context-loader)
 
 #### 📦 Breaking Changes
-- Package renamed `strray-ai` → `0xray` (npm: `npm install 0xray`, `npx 0xray --help`)
-- GitHub org: `0xRayAI/xray` (was `htafolla/StringRay`)
-- Root config dir: `xray/` (was `strray/`)
-- Version 2.0.0 under 0xRay org (not a merge to master; master remains v1.22)
-- Dynamo governance endpoint: removed hardcoded production URL, now requires `GOVERNANCE_ENDPOINT` env var
+- Version 2.0.0 under 0xRay org (not a merge to master)
 - aside-context.ts removed (was unused)
 - GovernOptions extended with timeoutMs and maxAbstentionThreshold