0xray 3.0.14 → 3.1.0

package/dist/skills/hermes-agent/SKILL.md

@@ -1,21 +1,21 @@
 ---
 name: hermes-agent
-description: Manage StringRay framework from Hermes Agent via the native strray-hermes plugin. Covers the 4 plugin tools (validate, codex_check, health, hooks), lifecycle hooks, slash commands, bridge architecture, and CLI fallback.
+description: Manage 0xRay framework from Hermes Agent via the native xray-hermes plugin. Covers the 4 plugin tools (validate, codex_check, health, hooks), lifecycle hooks, slash commands, bridge architecture, and CLI fallback.
 version: 2.1.0
-author: StringRay AI
+author: 0xRay AI
 metadata:
   hermes:
-    tags: [StringRay, Plugin, Validation, Codex, GitHooks, Bridge]
+    tags: [0xRay, Plugin, Validation, Codex, GitHooks, Bridge]
     related_skills: []
 ---
 
-# StringRay Hermes Plugin (strray-hermes)
+# 0xRay Hermes Plugin (xray-hermes)
 
-Native Hermes plugin providing StringRay framework integration — quality gates, codex enforcement, git hooks, and full pre/post processing pipeline. Runs via a Node.js bridge to compiled framework components.
+Native Hermes plugin providing 0xRay framework integration — quality gates, codex enforcement, git hooks, and full pre/post processing pipeline. Runs via a Node.js bridge to compiled framework components.
 
 ## When to Use
 
-- User asks about StringRay health, validation, or codex checks
+- User asks about 0xRay health, validation, or codex checks
 - User wants to install/manage git hooks for automated enforcement
 - User asks about the plugin's tools, hooks, or slash commands
 - User asks about bridge errors or framework not loading
@@ -24,11 +24,11 @@ Native Hermes plugin providing StringRay framework integration — quality gates
 ## Plugin Architecture
 
 ```
-~/.hermes/plugins/strray-hermes/
+~/.hermes/plugins/xray-hermes/
 ├── __init__.py         # Plugin registration, hooks, slash commands
 ├── tools.py            # 4 tool handlers (validate, codex_check, health, hooks)
 ├── schemas.py          # JSON schemas the LLM sees
-├── bridge.mjs          # Node.js bridge to compiled StringRay framework
+├── bridge.mjs          # Node.js bridge to compiled 0xRay framework
 ├── plugin.yaml         # Plugin metadata (name, version, tools, hooks)
 ├── types.py            # TypeScript-equivalent type definitions
 ├── after-install.md    # Post-install instructions
@@ -43,17 +43,17 @@ Native Hermes plugin providing StringRay framework integration — quality gates
 
 **Fallback:** When bridge is unavailable, tools fall back to `npx 0xray` CLI commands.
 
-**Config path resolution:** `STRRAY_CONFIG_DIR/` > `.strray/` > `.opencode/strray/` > built-in defaults.
+**Config path resolution:** `XRAY_CONFIG_DIR/` > `.xray/` > `.opencode/xray/` > built-in defaults.
 
 ## 4 Tools
 
-### strray_validate
+### xray_validate
 
 Run pre-commit validation on files. Uses bridge quality gate + processor pipeline, falls back to CLI.
 
 ```
-strray_validate(files=["src/my-module.ts"], operation="commit")
-strray_validate(files=["src/auth.ts", "src/auth.test.ts"], operation="modify")
+xray_validate(files=["src/my-module.ts"], operation="commit")
+xray_validate(files=["src/auth.ts", "src/auth.test.ts"], operation="modify")
 ```
 
 Parameters:
@@ -62,13 +62,13 @@ Parameters:
 
 Returns: pass/fail with per-file results and violations.
 
-### strray_codex_check
+### xray_codex_check
 
 Validate code against the 60-term Universal Development Codex. Checks error-handling, type-safety, performance, security, architecture.
 
 ```
-strray_codex_check(code="const x: any = foo()", operation="create")
-strray_codex_check(code=snippet, operation="modify", focus_areas=["security", "error-handling"])
+xray_codex_check(code="const x: any = foo()", operation="create")
+xray_codex_check(code=snippet, operation="modify", focus_areas=["security", "error-handling"])
 ```
 
 Parameters:
@@ -78,25 +78,25 @@ Parameters:
 
 Returns: violations list with actionable remediation.
 
-### strray_health
+### xray_health
 
 Framework health check. Returns version, loaded components, project root.
 
 ```
-strray_health()
+xray_health()
 ```
 
 Returns: framework status, version, component availability, node version.
 
-### strray_hooks
+### xray_hooks
 
-Manage StringRay git hooks (install, uninstall, list, status).
+Manage 0xRay git hooks (install, uninstall, list, status).
 
 ```
-strray_hooks(action="install")
-strray_hooks(action="status")
-strray_hooks(action="list")
-strray_hooks(action="uninstall", hooks=["pre-commit"])
+xray_hooks(action="install")
+xray_hooks(action="status")
+xray_hooks(action="list")
+xray_hooks(action="uninstall", hooks=["pre-commit"])
 ```
 
 Parameters:
@@ -122,7 +122,7 @@ Fires before ANY tool executes:
 1. Tracks session stats
 2. Logs tool-start event to `logs/framework/plugin-tool-events.log`
 3. For code-producing tools (write_file, patch, execute_code, write, edit): runs quality gate + pre-processors via bridge
-4. For other tools: nudges when a StringRay MCP alternative exists (e.g., grep → search_codebase, eslint → strray_lint)
+4. For other tools: nudges when a 0xRay MCP alternative exists (e.g., grep → search_codebase, eslint → xray_lint)
 
 ### post_tool_call
 
@@ -137,16 +137,16 @@ Fires when a new session starts. Resets stats and logs to disk. Registration is
 ## Slash Command
 
 ```
-/strray status    — Plugin and framework health (calls bridge)
-/strray stats     — Session pipeline statistics
-/strray help      — Show available commands
+/xray status    — Plugin and framework health (calls bridge)
+/xray stats     — Session pipeline statistics
+/xray help      — Show available commands
 /sr status        — Alias
 ```
 
 ## Session Stats (tracked automatically)
 
-The plugin tracks per-session counters visible via `/strray stats`:
-- total_tool_calls, code_operations, strray_mcp_calls, native_tool_calls
+The plugin tracks per-session counters visible via `/xray stats`:
+- total_tool_calls, code_operations, xray_mcp_calls, native_tool_calls
 - quality_gate_runs, quality_gate_blocks
 - pre_processor_runs, post_processor_runs
 - bridge_calls, bridge_errors
@@ -164,13 +164,13 @@ All logs go to `logs/framework/` in the project root:
 
 | User Says | Tool / Command |
 |----------|---------------|
-| "Is StringRay working?" | `strray_health()` or `/strray status` |
-| "Check these files before I commit" | `strray_validate(files=[...], operation="commit")` |
-| "Is this code codex compliant?" | `strray_codex_check(code=..., operation="create")` |
-| "Set up git hooks" | `strray_hooks(action="install")` |
-| "What hooks are installed?" | `strray_hooks(action="status")` |
-| "Show session stats" | `/strray stats` |
-| "Why is the bridge failing?" | Check `strray_health()` → if `framework: "not_loaded"`, verify `dist/` symlink |
+| "Is 0xRay working?" | `xray_health()` or `/xray status` |
+| "Check these files before I commit" | `xray_validate(files=[...], operation="commit")` |
+| "Is this code codex compliant?" | `xray_codex_check(code=..., operation="create")` |
+| "Set up git hooks" | `xray_hooks(action="install")` |
+| "What hooks are installed?" | `xray_hooks(action="status")` |
+| "Show session stats" | `/xray stats` |
+| "Why is the bridge failing?" | Check `xray_health()` → if `framework: "not_loaded"`, verify `dist/` symlink |
 
 ## Bridge Commands (internal)
 
@@ -188,8 +188,8 @@ These are called by the Python tools via `bridge.mjs`, not directly by the LLM:
 
 Bridge can be invoked directly for debugging:
 ```bash
-echo '{"command":"health"}' | node ~/.hermes/plugins/strray-hermes/bridge.mjs
-node ~/.hermes/plugins/strray-hermes/bridge.mjs health --cwd /path/to/project
+echo '{"command":"health"}' | node ~/.hermes/plugins/xray-hermes/bridge.mjs
+node ~/.hermes/plugins/xray-hermes/bridge.mjs health --cwd /path/to/project
 ```
 
 ## Relationship to MCP Servers
@@ -198,15 +198,15 @@ The plugin and MCP servers are complementary:
 - **Plugin tools** = offline-first, always available, lightweight (validate, codex check, health, hooks)
 - **MCP servers** = deeper analysis requiring running Node.js (lint, security scan, architecture assessment, orchestration, codebase search)
 
-The plugin's pre_tool_call hook nudges when an MCP alternative exists (e.g., "use mcp_strray_lint_lint instead of raw eslint"). This is advisory, not blocking.
+The plugin's pre_tool_call hook nudges when an MCP alternative exists (e.g., "use mcp_xray_lint_lint instead of raw eslint"). This is advisory, not blocking.
 
 ## Pitfalls
 
 - Plugin requires restart after install/edit: Hermes loads plugins once at session start.
 - Bridge needs `dist/` symlink: The bridge loads compiled `.js` from `dist/` → `node_modules/0xray/dist/`. If the symlink breaks, bridge returns `framework: "not_loaded"`.
-- `strray_codex_check` without `code` param returns health, not a codex check. Pass `code` for actual validation.
+- `xray_codex_check` without `code` param returns health, not a codex check. Pass `code` for actual validation.
 - CLI fallback requires `npx 0xray` in PATH. If bridge fails and CLI isn't available, tools return errors.
 - Quality gate blocks are logged but NOT enforced (advisory). The tool returns violations; the agent decides what to do.
-- Git hooks use symlinks from `.git/hooks/` → `hooks/`. If the `hooks/` directory doesn't exist in the project, `strray_hooks(action="install")` skips those hooks.
-- Project root detection walks up from CWD looking for `node_modules/0xray`, `.opencode/strray/features.json`, or `package.json`. Override with `STRRAY_PROJECT_ROOT` env var.
+- Git hooks use symlinks from `.git/hooks/` → `hooks/`. If the `hooks/` directory doesn't exist in the project, `xray_hooks(action="install")` skips those hooks.
+- Project root detection walks up from CWD looking for `node_modules/0xray`, `.opencode/xray/features.json`, or `package.json`. Override with `XRAY_PROJECT_ROOT` env var.
 - `logs/framework/` is created automatically. Never breaks the agent if permissions fail.

package/dist/skills/storyteller/SKILL.md

@@ -96,7 +96,7 @@ codex_terms: [5, 7, 32]  # Related Codex term numbers
 ```markdown
 ## What Next?
 
-- Related Codex terms: [codex.json](../../.opencode/strray/codex.json)
+- Related Codex terms: [codex.json](../../.opencode/xray/codex.json)
 - Next story to write: [suggestion]
 ```
 

package/dist/state/index.js

@@ -4,4 +4,5 @@ export * from "./state-manager.js";
 export * from "./context-providers.js";
 export * from "./state-types.js";
 // Re-export commonly used state utilities
-export { StringRayStateManager } from "./state-manager.js";
+export { XrayStateManager } from "./state-manager.js";
+export { XrayStateManager as StringRayStateManager } from "./state-manager.js";

package/dist/state/state-manager.js

@@ -1,6 +1,6 @@
 import { frameworkLogger } from "../core/framework-logger.js";
 import { resolveStateFilePath } from "../core/config-paths.js";
-export class StringRayStateManager {
+export class XrayStateManager {
     store = new Map();
     persistencePath;
     persistenceEnabled;
@@ -190,7 +190,7 @@ export class StringRayStateManager {
     }
     // Enterprise features for advanced state management
     getStateVersion() {
-        return StringRayStateManager.VERSION || "1.1.1";
+        return XrayStateManager.VERSION || "1.1.1";
     }
     getAuditLog() {
         return []; // Simplified implementation for testing
@@ -205,4 +205,4 @@ export class StringRayStateManager {
     }
 }
 // Export alias for scripts expecting StrRayStateManager (backward compatibility)
-export { StringRayStateManager as StrRayStateManager };
+export { XrayStateManager as StringRayStateManager };

package/dist/utils/token-manager.js

@@ -3,7 +3,7 @@ import * as path from "path";
 import { resolveConfigPath } from "../core/config-paths.js";
 export class TokenManager {
     config;
-    constructor(configPath = resolveConfigPath("config.json") || path.join(process.cwd(), ".strray", "config.json")) {
+    constructor(configPath = resolveConfigPath("config.json") || path.join(process.cwd(), ".xray", "config.json")) {
         this.config = this.loadConfig(configPath);
     }
     loadConfig(configPath) {

package/dist/validation/estimation-validator.js

@@ -12,7 +12,7 @@ import { frameworkLogger } from '../core/framework-logger.js';
 export class EstimationValidator {
     estimations = new Map();
     calibrations = new Map();
-    STORAGE_KEY = 'strray-estimations';
+    STORAGE_KEY = 'xray-estimations';
     constructor() {
         this.loadFromStorage();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "3.0.14",
+  "version": "3.1.0",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/node/pre-publish-guard.js

@@ -166,15 +166,19 @@ function checkVersionManagerRan() {
   
   // Check that files have been updated (look for recent timestamps or version)
   const { resolveConfigPath } = require('../helpers/resolve-config-path.cjs');
-  const featuresPath = resolveConfigPath('features.json', rootDir);
-  const features = JSON.parse(fs.readFileSync(featuresPath, 'utf-8'));
-  
-  // Version manager should have updated version fields
-  if (!features.version && !features.xray_version) {
-    warnings.push('features.json may not have been synced by version manager');
-    log('features.json may need version sync', 'warn');
-  } else {
-    log('Version manager appears to have run', 'success');
+  let features;
+  try {
+    const featuresPath = resolveConfigPath('features.json', rootDir);
+    features = JSON.parse(fs.readFileSync(featuresPath, 'utf-8'));
+    // Version manager should have updated version fields
+    if (!features.version && !features.xray_version) {
+      warnings.push('features.json may not have been synced by version manager');
+      log('features.json may need version sync', 'warn');
+    } else {
+      log('Version manager appears to have run', 'success');
+    }
+  } catch {
+    log('features.json not found — skipping version sync check', 'warn');
   }
   
   return true;

package/scripts/node/universal-version-manager.js

@@ -136,9 +136,9 @@ const CALCULATED_COUNTS = calculateCounts();
 const OFFICIAL_VERSIONS = {
   // Framework version
   framework: {
-    version: "3.0.14",
+    version: "3.1.0",
       displayName: "xray: Self-Healing AI Governance OS",
-      lastUpdated: "2026-06-14",
+      lastUpdated: "2026-06-15",
     // Counts (auto-calculated, but can be overridden)
     ...CALCULATED_COUNTS,
   },

package/src/mcps/config/__tests__/server-config-registry.test.ts

@@ -164,38 +164,38 @@ describe('ServerConfigRegistry', () => {
       expect(config.timeout).toBe(30000);
     });
 
-    it('should use STRRAY_DEV_PATH env var in dynamic config', () => {
-      const originalEnv = process.env.STRRAY_DEV_PATH;
-      process.env.STRRAY_DEV_PATH = 'custom-dist';
+    it('should use XRAY_DEV_PATH env var in dynamic config', () => {
+      const originalEnv = process.env.XRAY_DEV_PATH;
+      process.env.XRAY_DEV_PATH = 'custom-dist';
       
       const config = registry.createDynamicConfig('test-server');
       expect(config.args[0]).toContain('custom-dist');
       
-      process.env.STRRAY_DEV_PATH = originalEnv;
+      process.env.XRAY_DEV_PATH = originalEnv;
     });
   });
 
   describe('environment path handling', () => {
-    it('should use resolved framework path when STRRAY_DEV_PATH is not set', () => {
-      const originalEnv = process.env.STRRAY_DEV_PATH;
-      delete process.env.STRRAY_DEV_PATH;
+    it('should use resolved framework path when XRAY_DEV_PATH is not set', () => {
+      const originalEnv = process.env.XRAY_DEV_PATH;
+      delete process.env.XRAY_DEV_PATH;
       
       const freshRegistry = new ServerConfigRegistry();
       const config = freshRegistry.get('code-review');
       expect(config?.args[0]).toContain('.server.js');
       
-      process.env.STRRAY_DEV_PATH = originalEnv;
+      process.env.XRAY_DEV_PATH = originalEnv;
     });
 
-    it('should use STRRAY_DEV_PATH when set', () => {
-      const originalEnv = process.env.STRRAY_DEV_PATH;
-      process.env.STRRAY_DEV_PATH = 'dist';
+    it('should use XRAY_DEV_PATH when set', () => {
+      const originalEnv = process.env.XRAY_DEV_PATH;
+      process.env.XRAY_DEV_PATH = 'dist';
       
       const freshRegistry = new ServerConfigRegistry();
       const config = freshRegistry.get('code-review');
       expect(config?.args[0]).toContain('dist/');
       
-      process.env.STRRAY_DEV_PATH = originalEnv;
+      process.env.XRAY_DEV_PATH = originalEnv;
     });
   });
 

package/src/mcps/config/server-config-registry.ts

@@ -20,21 +20,21 @@ import fs from 'fs';
 /**
  * Resolve the correct framework root and MCP servers path.
  * Priority:
- *   1. STRRAY_DEV_PATH env var (explicit dev override)
- *   2. The "strray" field in the nearest package.json that declares it (works in both source tree and installed package)
+ *   1. XRAY_DEV_PATH env var (explicit dev override)
+ *   2. The "xray" field in the nearest package.json that declares it (works in both source tree and installed package)
  *   3. Safe fallback to node_modules/0xray/dist
  */
 function resolveFrameworkPaths(): { frameworkRoot: string; mcpServersPath: string } {
   // Highest priority: explicit environment override
-  if (process.env.STRRAY_DEV_PATH) {
-    const devPath = process.env.STRRAY_DEV_PATH;
+  if (process.env.XRAY_DEV_PATH) {
+    const devPath = process.env.XRAY_DEV_PATH;
     return {
       frameworkRoot: devPath,
       mcpServersPath: join(devPath, 'mcps'),
     };
   }
 
-  // Walk upward from this module to find the package that owns the "strray" config
+  // Walk upward from this module to find the package that owns the "xray" config
   let currentDir = dirname(fileURLToPath(import.meta.url));
 
   // Safety limit to avoid walking the entire filesystem
@@ -44,10 +44,10 @@ function resolveFrameworkPaths(): { frameworkRoot: string; mcpServersPath: strin
     if (fs.existsSync(pkgPath)) {
       try {
         const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-        if (pkg.name === '0xray' && pkg.strray) {
-          const strrayCfg = pkg.strray as Record<string, string>;
+        if (pkg.name === '0xray' && pkg.xray) {
+          const xrayCfg = pkg.xray as Record<string, string>;
           const frameworkRoot = currentDir;
-          const declaredMcp = strrayCfg.mcpServersPath || (strrayCfg.dist ? join(strrayCfg.dist, 'mcps') : 'dist/mcps');
+          const declaredMcp = xrayCfg.mcpServersPath || (xrayCfg.dist ? join(xrayCfg.dist, 'mcps') : 'dist/mcps');
           return {
             frameworkRoot,
             mcpServersPath: join(frameworkRoot, declaredMcp),
@@ -65,7 +65,7 @@ function resolveFrameworkPaths(): { frameworkRoot: string; mcpServersPath: strin
   // Final fallback (should almost never be reached)
   const fallback = 'node_modules/0xray/dist';
   frameworkLogger.log('server-config-registry', 'using-fallback-path', 'warning', {
-    reason: 'Could not locate strray package.json with "strray" field',
+    reason: 'Could not locate xray package.json with "xray" field',
     fallback,
   });
   return {
@@ -367,7 +367,7 @@ export class ServerConfigRegistry {
   /**
    * Create a dynamic configuration for an unknown server
    * Uses the knowledge-skills directory as default location.
-   * Now respects the "strray" field declared in package.json.
+   * Now respects the "xray" field declared in package.json.
    */
   createDynamicConfig(serverName: string): IServerConfig {
     // Validate serverName against path traversal attacks

package/src/mcps/connection/mcp-connection.ts

@@ -77,7 +77,7 @@ export class McpConnection extends EventEmitter implements IMcpConnection {
           protocolVersion: MCP_PROTOCOL_VERSION,
           capabilities: {},
           clientInfo: {
-            name: 'strray-mcp-client',
+            name: 'xray-mcp-client',
             version: '1.7.5',
           },
         },

package/src/mcps/framework-help.server.ts

@@ -40,7 +40,7 @@ class FrameworkHelpServer {
       return {
         tools: [
           {
-            name: "strray_get_capabilities",
+            name: "xray_get_capabilities",
             description:
               "Get comprehensive list of all 0xRay framework capabilities, commands, and available tools",
             inputSchema: {
@@ -63,7 +63,7 @@ class FrameworkHelpServer {
             },
           },
           {
-            name: "strray_get_commands",
+            name: "xray_get_commands",
             description:
               "Get list of available 0xRay commands and their usage",
             inputSchema: {
@@ -84,7 +84,7 @@ class FrameworkHelpServer {
             },
           },
           {
-            name: "strray_explain_capability",
+            name: "xray_explain_capability",
             description:
               "Get detailed explanation of a specific 0xRay capability",
             inputSchema: {
@@ -108,11 +108,11 @@ class FrameworkHelpServer {
 
       try {
         switch (name) {
-          case "strray_get_capabilities":
+          case "xray_get_capabilities":
             return this.handleGetCapabilities(args);
-          case "strray_get_commands":
+          case "xray_get_commands":
             return this.handleGetCommands(args);
-          case "strray_explain_capability":
+          case "xray_explain_capability":
             return this.handleExplainCapability(args);
           default:
             throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -15,6 +15,7 @@ import {
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 
 interface CodeReviewResult {
   file: string;
@@ -465,47 +466,31 @@ class XrayCodeReviewServer {
    */
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-    const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-
-    let decision: "approve" | "reject" | "abstain" = "approve";
-    let confidence = 0.82;
-    let reasoning = "The proposal appears reasonable from a code quality and maintainability perspective.";
-
-    if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-      decision = "approve";
-      confidence = 0.88;
-      reasoning = "AML/KYC compliance code requires rigorous review: transaction monitoring must handle edge cases, avoid false positives from legitimate patterns, and maintain audit trails for regulatory inspection.";
-    } else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-      decision = "approve";
-      confidence = 0.90;
-      reasoning = "PSD2 SCA implementation must balance security with user experience. Code should use well-audited MFA libraries, avoid rolling custom authentication, and include comprehensive test coverage for all authentication flows.";
-    } else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-      decision = "approve";
-      confidence = 0.92;
-      reasoning = "GDPR erasure pipelines require careful code review: cascading deletes must be transactional, audit logs must be preserved, and the 30-day SLA demands observability and monitoring integration.";
-    } else if (text.includes("extract method")) {
-      decision = "approve";
-      confidence = 0.93;
-      reasoning = "Extract Method is a well-established refactoring pattern that improves readability and reduces cognitive load when applied consistently.";
-    } else if (text.includes("test coverage")) {
-      decision = "approve";
-      confidence = 0.90;
-      reasoning = "Expanding automated test coverage generally improves long-term code health and reduces regression risk.";
-    } else if (text.includes("increase timeout") && text.includes("flaky")) {
-      decision = "reject";
-      confidence = 0.72;
-      reasoning = "Repeatedly increasing timeouts to mask flaky tests is an anti-pattern that hides underlying race conditions or timing issues.";
-    }
 
-    if (proposalType === "fix" && text.includes("timeout")) {
-      confidence = Math.max(0.68, confidence - 0.08);
+    const vote = await tryLLMGovernance(
+      "code-review",
+      proposalTitle,
+      proposalDescription,
+      evidence,
+      proposalType,
+    );
+
+    if (!vote) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+          },
+        ],
+      };
     }
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
         },
       ],
     };

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -15,6 +15,7 @@ import {
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 
 interface SecurityVulnerability {
   id: string;
@@ -1122,51 +1123,31 @@ class XraySecurityAuditServer {
    */
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-    const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-
-    let decision: "approve" | "reject" | "abstain" = "approve";
-    let confidence = 0.82;
-    let reasoning = "The proposal does not appear to introduce significant new security surface area.";
-
-    if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-      decision = "approve";
-      confidence = 0.91;
-      reasoning = "AML/KYC compliance measures are critical for regulatory security posture. Automated transaction monitoring closes vulnerability gaps in financial crime detection and demonstrates due diligence for regulatory inspections.";
-    } else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-      decision = "approve";
-      confidence = 0.93;
-      reasoning = "PSD2 SCA implementation is a mandatory security control for payment services. Multi-factor authentication with dynamic linking reduces unauthorized payment risk and satisfies EBA regulatory technical standards.";
-    } else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-      decision = "approve";
-      confidence = 0.94;
-      reasoning = "GDPR compliance controls are foundational to data security posture. Automated data erasure pipelines reduce data breach exposure windows and satisfy supervisory authority inspection requirements.";
-    } else if (text.includes("beneficial ownership") || text.includes("ubo") || text.includes("pep screening")) {
-      decision = "approve";
-      confidence = 0.87;
-      reasoning = "Beneficial ownership transparency and PEP screening are critical AML controls. Verifying ultimate beneficial owners reduces money laundering risk through corporate account structuring.";
-    } else if (text.includes("extract method")) {
-      decision = "approve";
-      confidence = 0.88;
-      reasoning = "Extract Method refactoring improves security posture by reducing attack surface in large monolithic files and enabling better isolation of sensitive logic.";
-    } else if (text.includes("test coverage")) {
-      decision = "approve";
-      confidence = 0.91;
-      reasoning = "Expanding test coverage is one of the highest-ROI security controls available — more tests surface regressions and boundary condition vulnerabilities earlier.";
-    } else if (text.includes("increase timeout") && text.includes("flaky")) {
-      decision = "reject";
-      confidence = 0.75;
-      reasoning = "Repeatedly increasing timeouts to hide flaky tests can mask timing attacks, race conditions, and resource exhaustion vulnerabilities. Root cause remediation is required.";
-    }
 
-    if (proposalType === "fix" && text.includes("timeout")) {
-      confidence = Math.max(0.65, confidence - 0.10);
+    const vote = await tryLLMGovernance(
+      "security-audit",
+      proposalTitle,
+      proposalDescription,
+      evidence,
+      proposalType,
+    );
+
+    if (!vote) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+          },
+        ],
+      };
     }
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
         },
       ],
     };

package/src/mcps/knowledge-skills/ui-ux-design.server.ts

@@ -1985,7 +1985,7 @@ Available: ${Object.keys(system.components).length} component types
     await this.server.connect(transport);
     await frameworkLogger.log(
       "ui-ux-design.server",
-      "-strray-ui-ux-design-mcp-server-running-",
+      "-xray-ui-ux-design-mcp-server-running-",
       "info",
       { message: "xray UI/UX Design MCP Server running..." },
     );
@@ -2011,7 +2011,7 @@ Available: ${Object.keys(system.components).length} component types
         clearTimeout(timeout);
         await frameworkLogger.log(
           "ui-ux-design.server",
-          "-strray-mcp-server-shut-down-gracefully-",
+          "-xray-mcp-server-shut-down-gracefully-",
           "info",
           { message: "xray MCP Server shut down gracefully" },
         );