0xray 3.4.7 → 3.4.9

package/AGENTS-consumer.md

@@ -4,7 +4,7 @@
 
 Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
 
-**v3.4.7** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
+**v3.4.9** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
 
 ## Postinstall (automatic)
 

package/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.4.7**).
+Quick reference for the xray AI orchestration framework (**v3.4.9**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/README.md

@@ -1,6 +1,20 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.4.7** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.4.9** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+
+## Your AI Power Suit
+
+**Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
+
+- learns with **Repertoire** 🧠
+- has a **Solar Ban Hammer** ☀️🔨 (Dynamo governance)
+- can also **Confer** 🗣️ (3-agent internal deliberation)
+
+The core AI Governance OS stack is **complete and open source**. A commercial version is next — powers up the suit further.
+
+```bash
+npm install 0xray@latest
+```
 
 xray is the pure v2 three-subsystem AI orchestration framework — **MCP-centric**, governed by Dynamo, and autonomous via thinDispatch. Consumer `npm install 0xray` auto-wires all four platform bridges and seven MCP servers with zero manual config.
 

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.4.7** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.4.9** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.4.7**).
+Quick reference for the xray AI orchestration framework (**v3.4.9**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/dist/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.4.9] - 2026-06-19
+
+### ⚠️ Breaking Changes
+- **`orchestrate-task`** — returns `success: false` when implementation agents (backend-engineer, frontend-engineer, bug-triage, etc.) are **deferred**. Only MCP consult skills execute in-process. Callers must not treat a completed response as work done; delegate via host `Task` / `spawn_subagent` per lead-dev-plan.
+
+### 🐛 Bug Fixes
+- **Orchestrator honesty** — no fake-complete for implementation agents; `delegate-deferred` + `lead-dev-plan-persisted` logged to `activity.log`
+- **`analyze-complexity` NaN** — `dependencyCount` + `dependencies[]` schema; numeric dependency hints no longer produce NaN scores
+- **Lead-dev plan** — `buildLeadDevPlan` uses per-task inputs; multi-task intake forces phased plan (not collapsed "Direct execution")
+- **Hermes governance voters** — route through `hermes -z` CLI (same path as groover `hermes-runner`); honor `HERMES_BIN`, `HERMES_HOME`
+
+### ✅ Tests
+- Unit coverage: `execution-planner-dependencies`, deferred task-handler, per-task lead-dev todos
+
+---
+
+## [3.4.8] - 2026-06-19
+
+### 🐛 Bug Fixes
+- **Hermes v2 OAuth** — governance LLM voters read `providers.xai-oauth.tokens` from `~/.hermes/auth.json` (npm consumers on modern Hermes no longer abstain)
+- **Headless deliberation** — honor `XRAY_GOVERNANCE_IN_PROCESS=1` for in-process skill voters without MCP subprocesses
+- **Governance MCP HTTP** — per-session Streamable HTTP transports on Railway
+
+### ✅ Tests
+- Unit coverage for Hermes v2 auth parsing and `XRAY_GOVERNANCE_IN_PROCESS` governance path
+
+---
+
 ## [3.4.7] - 2026-06-18
 
 ### 🐛 Bug Fixes

package/dist/README.md

@@ -1,6 +1,20 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.4.7** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.4.9** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+
+## Your AI Power Suit
+
+**Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
+
+- learns with **Repertoire** 🧠
+- has a **Solar Ban Hammer** ☀️🔨 (Dynamo governance)
+- can also **Confer** 🗣️ (3-agent internal deliberation)
+
+The core AI Governance OS stack is **complete and open source**. A commercial version is next — powers up the suit further.
+
+```bash
+npm install 0xray@latest
+```
 
 xray is the pure v2 three-subsystem AI orchestration framework — **MCP-centric**, governed by Dynamo, and autonomous via thinDispatch. Consumer `npm install 0xray` auto-wires all four platform bridges and seven MCP servers with zero manual config.
 

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.4.7** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.4.9** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/governance/governance-service.js

@@ -128,7 +128,9 @@ export class GovernanceService {
     }
     async callSkillServer(serverName, proposals, context) {
         const votes = [];
-        const useInProcess = process.env.VERCEL === '1' || !!process.env.RAILWAY_ENVIRONMENT;
+        const useInProcess = process.env.VERCEL === '1' ||
+            !!process.env.RAILWAY_ENVIRONMENT ||
+            process.env.XRAY_GOVERNANCE_IN_PROCESS === '1';
         for (const proposal of proposals) {
             try {
                 let text = '';

package/dist/governance/llm-governance-provider.d.ts

@@ -4,6 +4,8 @@ export interface GovernanceVote {
     confidence: number;
     reasoning: string;
 }
+export declare function resolveHermesBin(): string;
+export declare function hermesCliAvailable(): boolean;
 export declare function tryLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceVote | null>;
 export declare function checkHermesOAuthStatus(): {
     configured: boolean;

package/dist/governance/llm-governance-provider.js

@@ -1,9 +1,8 @@
-import { readFileSync, existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { execFileSync } from "node:child_process";
 import { frameworkLogger } from "../core/framework-logger.js";
-const XAI_ENDPOINT = "https://api.x.ai/v1/chat/completions";
-const XAI_MODEL = "grok-4.3";
+const DEFAULT_HERMES_PROVIDER = "xai-oauth";
+const DEFAULT_HERMES_MODEL = "grok-4.3";
+const DEFAULT_HERMES_TIMEOUT_MS = 120_000;
 const ROLE_PROMPTS = {
     "code-review": `You are a senior code reviewer on a governance committee for a software project. Analyze the following proposal from a code quality, maintainability, readability, and engineering best practices perspective.
 
@@ -42,69 +41,97 @@ DECISION: approve|reject|abstain
 CONFIDENCE: <0.0-1.0>
 REASONING: <2-4 sentence analysis of the proposal's broader project impact>`,
 };
-function readHermesOAuthToken() {
-    try {
-        const authPath = join(homedir(), ".hermes", "auth.json");
-        if (!existsSync(authPath))
-            return null;
-        const raw = readFileSync(authPath, "utf-8");
-        const data = JSON.parse(raw);
-        let entry;
-        if (data && typeof data === "object" && !Array.isArray(data)) {
-            entry = data["xai-oauth"];
-            if (!entry?.access_token && data.access_token) {
-                entry = data;
-            }
-        }
-        if (!entry?.access_token && Array.isArray(data)) {
-            entry = data.find((e) => e.provider === "xai-oauth" || !!e.access_token);
-        }
-        if (!entry?.access_token) {
-            process.stderr.write("[llm] readHermesOAuthToken: no access_token in auth file\n");
-            return null;
-        }
-        if (entry.expires_at && Date.now() / 1000 > entry.expires_at) {
-            frameworkLogger.log("llm-governance", "hermes-token-expired", "warning", { expiresAt: entry.expires_at });
-            return null;
-        }
-        return entry.access_token;
-    }
-    catch (err) {
-        frameworkLogger.log("llm-governance", "hermes-auth-read-error", "warning", { error: String(err) });
-        return null;
-    }
+function resolveHermesProvider() {
+    return process.env.HERMES_PROVIDER?.trim() || DEFAULT_HERMES_PROVIDER;
 }
-function getConfig() {
-    const directEndpoint = process.env.XRAY_LLM_ENDPOINT ||
+function resolveHermesModel() {
+    return process.env.HERMES_MODEL?.trim() || DEFAULT_HERMES_MODEL;
+}
+function resolveHermesTimeoutMs() {
+    const raw = process.env.HERMES_TIMEOUT_MS?.trim();
+    if (!raw)
+        return DEFAULT_HERMES_TIMEOUT_MS;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_HERMES_TIMEOUT_MS;
+}
+export function resolveHermesBin() {
+    const explicit = process.env.HERMES_BIN?.trim();
+    if (explicit)
+        return explicit;
+    return "hermes";
+}
+function getDirectLlmConfig() {
+    const endpoint = process.env.XRAY_LLM_ENDPOINT ||
         process.env.XRAY_GOVERNANCE_LLM_ENDPOINT ||
         "";
-    const directApiKey = process.env.XRAY_LLM_API_KEY ||
+    const apiKey = process.env.XRAY_LLM_API_KEY ||
         process.env.XRAY_GOVERNANCE_LLM_API_KEY ||
         "";
-    const directModel = process.env.XRAY_LLM_MODEL ||
+    const model = process.env.XRAY_LLM_MODEL ||
         process.env.XRAY_GOVERNANCE_LLM_MODEL ||
         "gpt-4o";
-    // First try: direct env-var config (highest priority)
     const directEnabled = process.env.XRAY_GOVERNANCE_LLM_ENABLED === "true" ||
         process.env.XRAY_LLM_ENABLED === "true";
-    if (directEnabled && directEndpoint && directApiKey) {
-        return { endpoint: directEndpoint, apiKey: directApiKey, model: directModel };
+    if (directEnabled && endpoint && apiKey) {
+        return { mode: "direct", endpoint, apiKey, model };
     }
-    // Second try: Hermes xAI OAuth token from ~/.hermes/auth.json
-    const hermesToken = readHermesOAuthToken();
-    if (hermesToken) {
-        frameworkLogger.log("llm-governance", "using-hermes-oauth", "info", { provider: "xai-oauth", endpoint: XAI_ENDPOINT, model: XAI_MODEL });
-        return { endpoint: XAI_ENDPOINT, apiKey: hermesToken, model: XAI_MODEL };
+    if (endpoint && apiKey) {
+        return { mode: "direct", endpoint, apiKey, model };
     }
-    // Third try: direct endpoint even without explicit enable flag (if endpoint+key set)
-    if (directEndpoint && directApiKey) {
-        return { endpoint: directEndpoint, apiKey: directApiKey, model: directModel };
-    }
-    if (process.env.DEBUG_LLM) {
-        process.stderr.write("[llm-debug] No config found. directEnabled=" + directEnabled + " endpoint=" + !!directEndpoint + " apiKey=" + !!directApiKey + " hermes=" + !!hermesToken + "\n");
+    return null;
+}
+function getConfig() {
+    const direct = getDirectLlmConfig();
+    if (direct)
+        return direct;
+    if (hermesCliAvailable()) {
+        return {
+            mode: "hermes",
+            provider: resolveHermesProvider(),
+            model: resolveHermesModel(),
+            timeoutMs: resolveHermesTimeoutMs(),
+        };
     }
     return null;
 }
+export function hermesCliAvailable() {
+    try {
+        execFileSync(resolveHermesBin(), ["--version"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 5_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function buildGovernancePrompt(role, proposalTitle, proposalDescription, evidence, proposalType) {
+    const evidenceBlock = evidence.length > 0
+        ? `**Supporting Evidence:**\n${evidence.map((entry, index) => `${index + 1}. ${entry}`).join("\n")}\n\n`
+        : "";
+    return `${ROLE_PROMPTS[role]}
+
+## Proposal
+
+**Title:** ${proposalTitle}
+
+**Description:** ${proposalDescription}
+
+**Type:** ${proposalType}
+
+${evidenceBlock}---
+
+Please provide your structured vote.`;
+}
+function runHermesGovernanceInference(prompt, config) {
+    return execFileSync(resolveHermesBin(), ["-z", prompt, "--provider", config.provider, "--model", config.model], {
+        encoding: "utf8",
+        timeout: config.timeoutMs,
+        maxBuffer: 10 * 1024 * 1024,
+    }).trim();
+}
 function parseVote(text) {
     const decisionMatch = text.match(/DECISION:\s*(approve|reject|abstain)/i);
     const confidenceMatch = text.match(/CONFIDENCE:\s*([0-9.]+)/i);
@@ -119,13 +146,7 @@ function parseVote(text) {
         reasoning: reasoningMatch?.[1]?.trim() || "No reasoning provided",
     };
 }
-export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
-    const config = getConfig();
-    if (!config) {
-        process.stderr.write("[llm] no config for role=" + role + "\n");
-        return null;
-    }
-    process.stderr.write("[llm] using config endpoint=" + config.endpoint + " model=" + config.model + "\n");
+async function callDirectLlm(role, config, proposalTitle, proposalDescription, evidence, proposalType) {
     const systemPrompt = ROLE_PROMPTS[role];
     const userMessage = `## Proposal
 
@@ -135,40 +156,61 @@ export async function tryLLMGovernance(role, proposalTitle, proposalDescription,
 
 **Type:** ${proposalType}
 
-${evidence.length > 0 ? `**Supporting Evidence:**\n${evidence.map((e, i) => `${i + 1}. ${e}`).join("\n")}` : ""}
+${evidence.length > 0 ? `**Supporting Evidence:**\n${evidence.map((entry, index) => `${index + 1}. ${entry}`).join("\n")}` : ""}
 
 ---
 
 Please provide your structured vote.`;
-    try {
-        const response = await fetch(config.endpoint, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${config.apiKey}`,
-            },
-            body: JSON.stringify({
-                model: config.model,
-                messages: [
-                    { role: "system", content: systemPrompt },
-                    { role: "user", content: userMessage },
-                ],
-                temperature: 0.3,
-                max_tokens: 500,
-            }),
+    const response = await fetch(config.endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${config.apiKey}`,
+        },
+        body: JSON.stringify({
+            model: config.model,
+            messages: [
+                { role: "system", content: systemPrompt },
+                { role: "user", content: userMessage },
+            ],
+            temperature: 0.3,
+            max_tokens: 500,
+        }),
+    });
+    if (!response.ok) {
+        frameworkLogger.log("llm-governance", "api-call", "error", {
+            status: response.status,
+            statusText: response.statusText,
+            role,
         });
-        if (!response.ok) {
-            frameworkLogger.log("llm-governance", "api-call", "error", {
-                status: response.status,
-                statusText: response.statusText,
-                role,
-            });
-            return null;
-        }
-        const data = (await response.json());
-        const choices = data?.choices;
-        const message = choices?.[0]?.message;
-        const content = message?.content;
+        return null;
+    }
+    const data = (await response.json());
+    const choices = data?.choices;
+    const message = choices?.[0]?.message;
+    return message?.content ?? null;
+}
+export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
+    const config = getConfig();
+    if (!config) {
+        process.stderr.write(`[llm] no config for role=${role}\n`);
+        return null;
+    }
+    if (config.mode === "hermes") {
+        process.stderr.write(`[llm] using hermes -z provider=${config.provider} model=${config.model}\n`);
+        frameworkLogger.log("llm-governance", "using-hermes-cli", "info", {
+            provider: config.provider,
+            model: config.model,
+            role,
+        });
+    }
+    else {
+        process.stderr.write(`[llm] using direct endpoint=${config.endpoint} model=${config.model}\n`);
+    }
+    try {
+        const content = config.mode === "hermes"
+            ? runHermesGovernanceInference(buildGovernancePrompt(role, proposalTitle, proposalDescription, evidence, proposalType), config)
+            : await callDirectLlm(role, config, proposalTitle, proposalDescription, evidence, proposalType);
         if (!content) {
             frameworkLogger.log("llm-governance", "parse", "warning", {
                 issue: "missing content in response",
@@ -201,23 +243,23 @@ Please provide your structured vote.`;
     }
 }
 export function checkHermesOAuthStatus() {
-    const config = getConfig();
-    if (!config) {
-        const hermesPath = join(homedir(), ".hermes", "auth.json");
-        if (existsSync(hermesPath)) {
-            return {
-                configured: false,
-                error: "Hermes auth file found but no valid xai-oauth token. Run: hermes auth add xai-oauth --no-browser",
-            };
-        }
+    const direct = getDirectLlmConfig();
+    if (direct) {
+        return {
+            configured: true,
+            endpoint: direct.endpoint,
+            model: direct.model,
+        };
+    }
+    if (hermesCliAvailable()) {
         return {
-            configured: false,
-            error: "No Hermes auth file found (~/.hermes/auth.json). Install Hermes and run: hermes auth add xai-oauth --no-browser",
+            configured: true,
+            endpoint: "hermes-cli",
+            model: resolveHermesModel(),
         };
     }
     return {
-        configured: true,
-        endpoint: XAI_ENDPOINT,
-        model: XAI_MODEL,
+        configured: false,
+        error: "Hermes CLI not found on PATH. Install Hermes and ensure xai-oauth is configured (same path as gateway/cron: hermes auth add xai-oauth).",
     };
 }

package/dist/mcps/governance.server.d.ts

@@ -29,6 +29,7 @@ declare class GovernanceServer extends XrayKnowledgeSkillBase {
     connect(transport: Transport): Promise<void>;
     /**
      * Run as HTTP server using Streamable HTTP transport (for Grok CLI compatibility).
+     * Uses per-session transports so concurrent clients can each initialize independently.
      */
     runHttp(port?: number): Promise<void>;
 }

package/dist/mcps/governance.server.js

@@ -13,7 +13,7 @@
  */
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
-import { CallToolRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { CallToolRequestSchema, isInitializeRequest, } from "@modelcontextprotocol/sdk/types.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
 import { frameworkLogger } from "../core/framework-logger.js";
 import { featuresConfigLoader } from "../core/features-config.js";
@@ -351,6 +351,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
     }
     /**
      * Run as HTTP server using Streamable HTTP transport (for Grok CLI compatibility).
+     * Uses per-session transports so concurrent clients can each initialize independently.
      */
     async runHttp(port = parseInt(process.env.MCP_PORT ?? "3100", 10)) {
         await this.initializeGovernance();
@@ -360,10 +361,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
             host: mcpHost,
             ...(allowedHosts ? { allowedHosts } : {}),
         });
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: () => randomUUID(),
-        });
-        await this.server.connect(transport);
+        const transports = {};
         const apiKey = process.env.GOVERNANCE_API_KEY;
         if (apiKey) {
             frameworkLogger.log("governance-mcp", "api-key-auth-enabled", "info", {});
@@ -383,8 +381,45 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
             }
             next();
         });
-        app.post("/mcp", async (req, res) => {
+        const mcpPostHandler = async (req, res) => {
             try {
+                const sessionId = req.headers["mcp-session-id"];
+                let transport;
+                if (sessionId && transports[sessionId]) {
+                    transport = transports[sessionId];
+                }
+                else if (!sessionId && isInitializeRequest(req.body)) {
+                    transport = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => randomUUID(),
+                        onsessioninitialized: (sid) => {
+                            if (transport) {
+                                transports[sid] = transport;
+                                frameworkLogger.log("governance-mcp", "session-initialized", "info", {
+                                    sessionId: sid,
+                                });
+                            }
+                        },
+                    });
+                    transport.onclose = () => {
+                        const sid = transport?.sessionId;
+                        if (sid && transports[sid]) {
+                            delete transports[sid];
+                            frameworkLogger.log("governance-mcp", "session-closed", "info", { sessionId: sid });
+                        }
+                    };
+                    const sessionServer = new GovernanceServer();
+                    await sessionServer.connect(transport);
+                    await transport.handleRequest(req, res, req.body);
+                    return;
+                }
+                else {
+                    res.status(400).json({
+                        jsonrpc: "2.0",
+                        error: { code: -32000, message: "Bad Request: No valid session ID provided" },
+                        id: null,
+                    });
+                    return;
+                }
                 await transport.handleRequest(req, res, req.body);
             }
             catch (error) {
@@ -393,15 +428,51 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
                     res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message: "Internal error" }, id: null });
                 }
             }
+        };
+        app.post("/mcp", mcpPostHandler);
+        app.get("/mcp", async (req, res) => {
+            const sessionId = req.headers["mcp-session-id"];
+            if (!sessionId || !transports[sessionId]) {
+                res.status(400).send("Invalid or missing session ID");
+                return;
+            }
+            try {
+                await transports[sessionId].handleRequest(req, res);
+            }
+            catch (error) {
+                frameworkLogger.log("governance-mcp", "http-sse-error", "error", { error: String(error) });
+                if (!res.headersSent) {
+                    res.status(500).send("Error processing SSE stream");
+                }
+            }
+        });
+        app.delete("/mcp", async (req, res) => {
+            const sessionId = req.headers["mcp-session-id"];
+            if (!sessionId || !transports[sessionId]) {
+                res.status(400).send("Invalid or missing session ID");
+                return;
+            }
+            try {
+                await transports[sessionId].handleRequest(req, res);
+            }
+            catch (error) {
+                frameworkLogger.log("governance-mcp", "http-delete-error", "error", { error: String(error) });
+                if (!res.headersSent) {
+                    res.status(500).send("Error processing session termination");
+                }
+            }
         });
         app.get("/health", (_req, res) => {
             res.json({ status: "ok", server: "governance" });
         });
+        const closeAllTransports = async () => {
+            await Promise.all(Object.values(transports).map((t) => t.close()));
+        };
         app.listen(port, () => {
             frameworkLogger.log("governance-mcp", "http-listening", "info", { port });
         });
-        process.on("SIGINT", () => { transport.close(); process.exit(0); });
-        process.on("SIGTERM", () => { transport.close(); process.exit(0); });
+        process.on("SIGINT", () => { void closeAllTransports().then(() => process.exit(0)); });
+        process.on("SIGTERM", () => { void closeAllTransports().then(() => process.exit(0)); });
     }
 }
 // Start the server if this file is run directly

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -321,7 +321,7 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
                 content: [
                     {
                         type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
                     },
                 ],
             };

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -666,7 +666,7 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
                 content: [
                     {
                         type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
                     },
                 ],
             };

package/dist/mcps/orchestrator/config/memory-routing-bridge.js

@@ -34,8 +34,9 @@ export function toMemoryTask(task) {
     };
     if (task.priority)
         result.priority = task.priority;
-    if (task.dependencies)
+    if (Array.isArray(task.dependencies) && task.dependencies.length > 0) {
         result.dependencies = task.dependencies;
+    }
     if (task.estimatedComplexity !== undefined)
         result.estimatedComplexity = task.estimatedComplexity;
     if (task.metadata)

package/dist/mcps/orchestrator/execution/execution-planner.d.ts

@@ -4,6 +4,8 @@
  * Creates optimized execution plans for orchestration tasks
  */
 import type { OrchestrationTask, ExecutionPlan, ComplexityAnalysis, TaskValidation } from '../types.js';
+/** Dependency count from task-ID list or numeric hint from analyze-complexity */
+export declare function dependencyCount(deps: OrchestrationTask['dependencies'] | undefined): number;
 /**
  * Execution Planner
  * Plans and optimizes task execution strategies