0xray 3.5.0 → 3.5.2

package/.gitignore.default

@@ -20,6 +20,13 @@ credentials.json
 *.pem
 *.key
 
+# 0xray suit artifacts (postinstall / bridge install)
+.grok/
+.mcp.json
+opencode.json
+AGENTS.md
+SKILLS.md
+
 # Runtime state (xray inference workflows, session state)
 .xray/
 .strray/
@@ -41,6 +48,7 @@ xray/inference/
 
 # Logs
 logs/
+logs/framework/
 *.log
 
 # OS files

package/.opencode/hooks/post-commit

@@ -20,39 +20,19 @@ BRANCH=$(git rev-parse --abbrev-ref HEAD)
   fi
 ) &
 
-# Load auto_reflection config from features.json
-CONFIG_FILE="$PROJECT_ROOT/.xray/features.json"
+# Load reflection config — synthesis.reflection SSOT, fallback auto_reflection
 MODE="minimal"
 COMMIT_THRESHOLD=25
 DAYS_THRESHOLD=14
 AUTO_GENERATE=true
 PROMPT_USER=true
 
-if [ -f "$CONFIG_FILE" ]; then
-  MODE=$(grep -o '"mode": *"[^"]*"' "$CONFIG_FILE" | cut -d'"' -f4)
-  MODE=${MODE:-minimal}
-  
-  # Get thresholds based on mode
-  case "$MODE" in
-    full)
-      COMMIT_THRESHOLD=10
-      DAYS_THRESHOLD=5
-      AUTO_GENERATE=true
-      PROMPT_USER=true
-      ;;
-    minimal)
-      COMMIT_THRESHOLD=25
-      DAYS_THRESHOLD=14
-      AUTO_GENERATE=true
-      PROMPT_USER=true
-      ;;
-    off)
-      COMMIT_THRESHOLD=999
-      DAYS_THRESHOLD=365
-      AUTO_GENERATE=false
-      PROMPT_USER=false
-      ;;
-  esac
+if command -v node >/dev/null 2>&1; then
+  LOAD_SCRIPT="$PROJECT_ROOT/scripts/node/load-reflection-config.mjs"
+  if [ -f "$LOAD_SCRIPT" ]; then
+    export PROJECT_ROOT="$PROJECT_ROOT"
+    eval "$(node "$LOAD_SCRIPT")"
+  fi
 fi
 
 # Check if this was a significant commit - prompt for reflection

package/.xray/features.json

@@ -141,6 +141,12 @@
     "module_path": "",
     "config": {}
   },
+  "synthesis": {
+    "enabled": false,
+    "every_n_gates": 12,
+    "every_n_turns": 0,
+    "every_n_todos_completed": 0
+  },
   "inference_governance": {
     "enabled": false,
     "request_timeout_ms": 10000,

package/.xray/features.schema.json

@@ -27,6 +27,23 @@
       "then": {
         "required": ["module_path"]
       }
+    },
+    "synthesis": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "every_n_gates": { "type": "integer", "minimum": 0 },
+        "every_n_turns": { "type": "integer", "minimum": 0 },
+        "every_n_todos_completed": { "type": "integer", "minimum": 0 },
+        "reflection": {
+          "type": "object",
+          "properties": {
+            "mode": { "type": "string", "enum": ["full", "minimal", "off"] },
+            "triggers": { "type": "object" },
+            "thresholds": { "type": "object" }
+          }
+        }
+      }
     }
   },
   "additionalProperties": true

package/AGENTS-consumer.md

@@ -4,7 +4,7 @@
 
 Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
 
-**v3.5.0** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
+**v3.5.2** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
 
 ## Postinstall (automatic)
 

package/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.5.0**).
+Quick reference for the xray AI orchestration framework (**v3.5.2**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/README.md

@@ -1,6 +1,6 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.5.0** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.5.2** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
 
 ## Your AI Power Suit
 

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.5.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.5.2** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/.gitignore.default

@@ -20,6 +20,13 @@ credentials.json
 *.pem
 *.key
 
+# 0xray suit artifacts (postinstall / bridge install)
+.grok/
+.mcp.json
+opencode.json
+AGENTS.md
+SKILLS.md
+
 # Runtime state (xray inference workflows, session state)
 .xray/
 .strray/
@@ -41,6 +48,7 @@ xray/inference/
 
 # Logs
 logs/
+logs/framework/
 *.log
 
 # OS files

package/dist/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.5.0**).
+Quick reference for the xray AI orchestration framework (**v3.5.2**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/dist/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.5.2] - 2026-06-19
+
+### 🐛 Bug Fixes
+- **Grok synthesis gate** — `pre-tool-use.js` wires `evaluatePreToolGate` SSOT (synthesis deny, gate slices, `govern-and-apply` block); fail-closed on hook errors
+- **Consumer bridge root** — `findProjectRoot` git-root + devDependency detection; `findGitRoot` applies `normalizePath`
+- **Consumer hooks** — stale xray pre-commit reinstall; post-commit hook installed; pre-commit fails closed when runner missing; non-xray hooks backed up before overwrite
+- **Consumer `.gitignore`** — idempotent suit block merge on postinstall; preserves orphan tail on incomplete marker
+- **`bridge.mjs`** — `handleGetConfig` fixes undeclared `envDir` ReferenceError
+- **Post-commit reflection** — `load-reflection-config.mjs` mode whitelist + `--json` output (no shell `eval`); macOS/BSD `stat` support
+
+### ✅ Tests
+- `verify-grok-synthesis-gate.mjs` (4/4 live Grok hook); chained in `verify:grok-delegation-gate` and `verify:delegation-gate`
+- `verify-consumer-gitignore` incomplete-marker fixture; `verify:find-project-root` 3/3
+
+---
+
+## [3.5.1] - 2026-06-19
+
+### ✨ Features
+- **Multi-host delegation gates** — `src/nucleus/delegation-gate.ts` SSOT; `evaluatePreToolGate` / `evaluatePostToolSpawn` shared across Grok, Hermes, OpenCode
+- **Hermes** — `pre_tool_call` returns `{"action":"block"}` via bridge `delegation-gate`; `post_tool_call` clears pending on `delegate_task`
+- **OpenCode** — `tool.execute.before` / `after` enforce delegation gate + post-spawn clear
+
+### ✅ Tests
+- `delegation-gate.test.ts`; `verify-delegation-gate-core.mjs`; `verify-hermes-delegation-gate.mjs`; shared `delegation-gate-fixture.mjs`
+- Grok hook-utils deduped — re-exports nucleus SSOT via `delegation-gate-runtime.mjs`
+
+### 📋 Deferred
+- **OpenClaw host veto** — no consumer tool-block API; observability-only until platform supports pre-tool deny
+
+---
+
 ## [3.5.0] - 2026-06-19
 
 ### ✨ Features

package/dist/README.md

@@ -1,6 +1,6 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.5.0** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.5.2** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
 
 ## Your AI Power Suit
 

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.5.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.5.2** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/core/bridge.mjs

@@ -51,6 +51,7 @@ import { join, dirname, resolve, relative } from "path";
 import { fileURLToPath } from "url";
 import { homedir } from "os";
 import { createServer } from "http";
+import { findProjectRoot } from "../../scripts/helpers/find-project-root.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -63,35 +64,11 @@ let CodexFormatterModule = null;
 let frameworkReady = false;
 let frameworkLoadAttempted = false;
 
-// ============================================================================
-// Project Root Detection
-// ============================================================================
-
-function findProjectRoot() {
-  const envHome = process.env.XRAY_HOME;
-  if (envHome && existsSync(join(envHome, "package.json"))) return envHome;
-
-  const candidates = [
-    process.cwd(),
-    join(homedir(), "dev", "xray"),
-    join(dirname(__dirname), "..", ".."), // core/ -> project root
-    join(dirname(__dirname), "..", "..", ".."), // integrations/ -> project root
-  ];
-
-  for (const dir of candidates) {
-    try {
-      const pkgPath = join(dir, "package.json");
-      if (existsSync(pkgPath)) {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-        if (pkg.name === "0xray" || pkg.dependencies?.["0xray"]) {
-          return dir;
-        }
-      }
-    } catch {
-      continue;
-    }
-  }
-  return process.cwd();
+function resolveBridgeProjectRoot() {
+  return findProjectRoot([
+    join(dirname(__dirname), "..", ".."),
+    join(dirname(__dirname), "..", "..", ".."),
+  ]);
 }
 
 // ============================================================================
@@ -184,7 +161,7 @@ const BRIDGE_CODEX_FALLBACK = {
 // ============================================================================
 
 async function handleHealth(input) {
-  const projectRoot = findProjectRoot();
+  const projectRoot = resolveBridgeProjectRoot();
   const loaded = await loadFramework(projectRoot);
 
   const pkgPath = join(projectRoot, "package.json");
@@ -313,6 +290,7 @@ async function handleGetCodexPrompt(input, projectRoot, logDir) {
 
 async function handleGetConfig(input, projectRoot, logDir) {
   logToActivity(logDir, "get-config");
+  const envDir = process.env.XRAY_CONFIG_DIR;
 
   const result = {
     status: "ok",
@@ -374,7 +352,7 @@ async function handleStats() {
     codexFormatterAvailable: !!CodexFormatterModule,
     qualityGateAvailable: !!QualityGateModule,
     nodeVersion: process.version,
-    projectRoot: findProjectRoot(),
+    projectRoot: resolveBridgeProjectRoot(),
   };
 }
 
@@ -893,7 +871,7 @@ async function main() {
     }
   }
 
-  const projectRoot = findProjectRoot();
+  const projectRoot = resolveBridgeProjectRoot();
   const logDir = ensureLogDir(projectRoot);
 
   // Lazy-load framework

package/dist/core/features-config.d.ts

@@ -66,6 +66,21 @@ export interface MultiAgentOrchestrationConfig {
     /** 3.5.0 — PreToolUse gate after delegate-deferred (default true when lead_dev_mode) */
     auto_chain_delegations?: boolean;
 }
+/** Reflection triggers merged from legacy auto_reflection when synthesis is configured */
+export interface SynthesisReflectionConfig {
+    mode?: AutoReflectionConfig['mode'];
+    triggers?: AutoReflectionConfig['triggers'];
+    thresholds?: AutoReflectionConfig['thresholds'];
+}
+/** 3.6.0 — periodic reflect & realign checkpoint (Synthesis PR1) */
+export interface SynthesisConfig {
+    enabled: boolean;
+    every_n_gates: number;
+    every_n_turns: number;
+    every_n_todos_completed: number;
+    /** SSOT for reflection triggers when synthesis enabled; seeded from auto_reflection */
+    reflection?: SynthesisReflectionConfig;
+}
 export interface AutonomousReportingConfig {
     enabled: boolean;
     interval_minutes: number;
@@ -369,6 +384,7 @@ export interface FeaturesConfig {
     auto_reflection?: AutoReflectionConfig;
     inference?: InferenceConfig;
     memory_routing?: MemoryRoutingConfig;
+    synthesis: SynthesisConfig;
     kernel?: KernelConfig;
     processors?: ProcessorsConfig;
     enforcement?: EnforcementConfig;

package/dist/core/features-config.js

@@ -278,6 +278,24 @@ export class FeaturesConfigLoader {
                 ...defaults.caching,
                 ...configData.caching,
             },
+            synthesis: (() => {
+                const merged = {
+                    ...defaults.synthesis,
+                    ...configData.synthesis,
+                };
+                const reflection = configData.synthesis?.reflection ??
+                    (configData.auto_reflection
+                        ? {
+                            mode: configData.auto_reflection.mode,
+                            triggers: configData.auto_reflection.triggers,
+                            thresholds: configData.auto_reflection.thresholds,
+                        }
+                        : undefined);
+                if (reflection) {
+                    merged.reflection = reflection;
+                }
+                return merged;
+            })(),
         };
     }
     /**
@@ -391,6 +409,12 @@ export class FeaturesConfigLoader {
                 cache_ttl_seconds: 300,
                 max_cache_size_mb: 50,
             },
+            synthesis: {
+                enabled: false,
+                every_n_gates: 12,
+                every_n_turns: 0,
+                every_n_todos_completed: 0,
+            },
         };
     }
     /**