0xray 3.5.0 → 3.5.2

package/scripts/mjs/verify-hermes-delegation-gate.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * Hermes bridge delegation gate fixture (4/4) — uses bridge delegation-gate command.
+ */
+import { execSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  FIXTURE_SESSION_ID,
+  seedDelegationGateFixture,
+  seedSpawnTodoPlan,
+} from './delegation-gate-fixture.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+const bridge = join(packageRoot, 'dist/integrations/hermes-agent/bridge.mjs');
+
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+function runBridge(payload, cwd) {
+  const json = JSON.stringify(payload).replace(/'/g, "'\\''");
+  const out = execSync(`node "${bridge}" delegation-gate --cwd "${cwd}" '${json}'`, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, XRAY_ROOT: cwd },
+  });
+  return JSON.parse(out.trim());
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-hermes-gate-'));
+seedDelegationGateFixture(tmp);
+
+const base = {
+  command: 'delegation-gate',
+  phase: 'pre',
+  sessionId: FIXTURE_SESSION_ID,
+  host: 'hermes',
+};
+
+try {
+  const deny = runBridge({ ...base, tool: 'write_file', args: { path: 'src/a.ts', content: 'x' } }, tmp);
+  if (deny.allow === false && deny.gate === 'auto-chain-pending') pass('bridge denies write while pending');
+  else fail('write deny', JSON.stringify(deny));
+
+  const allowRead = runBridge({ ...base, tool: 'read_file', args: { path: 'src/a.ts' } }, tmp);
+  if (allowRead.allow === true) pass('bridge allows read while pending');
+  else fail('read allow', JSON.stringify(allowRead));
+
+  const allowSpawn = runBridge(
+    {
+      ...base,
+      tool: 'delegate_task',
+      args: { prompt: 'plan todo 2.1 swap deps', subagent_type: 'backend-engineer' },
+    },
+    tmp,
+  );
+  if (allowSpawn.allow === true) pass('bridge allows delegate_task while pending');
+  else fail('spawn allow', JSON.stringify(allowSpawn));
+
+  seedSpawnTodoPlan(tmp);
+  const denyTodo = runBridge(
+    { ...base, tool: 'delegate_task', args: { prompt: 'explore only', subagent_type: 'explore' } },
+    tmp,
+  );
+  if (denyTodo.allow === false && denyTodo.gate === 'spawn-todo-persistence') {
+    pass('bridge denies spawn skipping required plan todo');
+  } else {
+    fail('spawn todo persistence', JSON.stringify(denyTodo));
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+console.log(
+  '\n' +
+    (failed === 0
+      ? '🎉 Hermes delegation gate verify passed (4/4).'
+      : `⚠️  ${failed} Hermes gate check(s) failed.`),
+);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/node/auto-reflection-generator.mjs

@@ -113,6 +113,13 @@ function loadConfig() {
     try {
       const content = readFileSync(configPath, "utf-8");
       const parsed = JSON.parse(content);
+      if (parsed.synthesis?.reflection) {
+        return {
+          mode: parsed.synthesis.reflection.mode ?? "minimal",
+          triggers: parsed.synthesis.reflection.triggers,
+          thresholds: parsed.synthesis.reflection.thresholds,
+        };
+      }
       if (parsed.auto_reflection) {
         return parsed.auto_reflection;
       }

package/scripts/node/consumer-gitignore.cjs

@@ -0,0 +1,101 @@
+/**
+ * Consumer .gitignore — template + idempotent merge into existing .gitignore.
+ */
+const fs = require("fs");
+const path = require("path");
+
+const MARKER_START = "# --- 0xray suit (postinstall) ---";
+const MARKER_END = "# --- end 0xray suit ---";
+
+/** Suit artifacts dropped by postinstall / install-bridges — keep out of product repos */
+const SUIT_IGNORE_LINES = [
+  ".grok/",
+  ".mcp.json",
+  "opencode.json",
+  "AGENTS.md",
+  "SKILLS.md",
+  ".xray/",
+  ".strray/",
+  "strray/",
+  ".hermes/",
+  ".opencode/agents/",
+  ".opencode/commands/",
+  ".opencode/workflows/",
+  ".opencode/codex.codex",
+  ".opencode/enforcer-config.json",
+  ".opencode/skills/",
+  ".opencode/scripts/",
+  ".opencode/logs/",
+  ".opencode/validation/",
+  ".opencode/triage/",
+  "logs/framework/",
+];
+
+function buildMarkerBlock(lines = SUIT_IGNORE_LINES) {
+  return [MARKER_START, ...lines, MARKER_END].join("\n");
+}
+
+function stripMarkerBlock(content) {
+  const start = content.indexOf(MARKER_START);
+  if (start === -1) return content;
+  const end = content.indexOf(MARKER_END);
+  if (end === -1) {
+    // Incomplete marker — preserve content before START; orphan tail handled in merge
+    return content.slice(0, start).trimEnd();
+  }
+  const tail = content.slice(end + MARKER_END.length);
+  return `${content.slice(0, start).trimEnd()}${tail}`.trimEnd();
+}
+
+function markerBlockIsCurrent(raw) {
+  if (!raw.includes(MARKER_START) || !raw.includes(MARKER_END)) {
+    return false;
+  }
+  const start = raw.indexOf(MARKER_START);
+  const end = raw.indexOf(MARKER_END) + MARKER_END.length;
+  const blockSection = raw.slice(start, end);
+  return SUIT_IGNORE_LINES.every((line) => blockSection.includes(line));
+}
+
+/**
+ * @returns {'created' | 'merged' | 'unchanged'}
+ */
+function applyConsumerGitignore(targetDir, packageRoot) {
+  const gitignoreSource = path.join(packageRoot, ".gitignore.default");
+  const gitignoreDest = path.join(targetDir, ".gitignore");
+
+  if (!fs.existsSync(gitignoreSource)) {
+    return "unchanged";
+  }
+
+  if (!fs.existsSync(gitignoreDest)) {
+    fs.copyFileSync(gitignoreSource, gitignoreDest);
+    return "created";
+  }
+
+  const raw = fs.readFileSync(gitignoreDest, "utf8");
+  if (markerBlockIsCurrent(raw)) {
+    return "unchanged";
+  }
+
+  const hasIncompleteMarker =
+    raw.includes(MARKER_START) && !raw.includes(MARKER_END);
+  const orphanTail = hasIncompleteMarker
+    ? raw.slice(raw.indexOf(MARKER_START)).trimEnd()
+    : "";
+  const content = stripMarkerBlock(raw);
+  const next = orphanTail
+    ? `${content.trimEnd()}\n\n${buildMarkerBlock()}\n\n${orphanTail}\n`
+    : `${content.trimEnd()}\n\n${buildMarkerBlock()}\n`;
+  fs.writeFileSync(gitignoreDest, next);
+  return "merged";
+}
+
+module.exports = {
+  MARKER_START,
+  MARKER_END,
+  SUIT_IGNORE_LINES,
+  buildMarkerBlock,
+  stripMarkerBlock,
+  applyConsumerGitignore,
+};

package/scripts/node/load-reflection-config.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * Emit reflection config for post-commit hook.
+ * SSOT: synthesis.reflection, fallback auto_reflection.
+ *
+ * Usage:
+ *   node load-reflection-config.mjs          # shell-safe export lines
+ *   node load-reflection-config.mjs --json   # JSON for hook parsers
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const ALLOWED_MODES = new Set(['minimal', 'full', 'off']);
+
+const root = process.env.PROJECT_ROOT || process.cwd();
+const configPath = join(root, '.xray', 'features.json');
+
+let mode = 'minimal';
+let commitThreshold = 25;
+let daysThreshold = 14;
+let autoGenerate = true;
+let promptUser = true;
+
+if (existsSync(configPath)) {
+  try {
+    const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
+    const reflection = parsed.synthesis?.reflection ?? parsed.auto_reflection;
+    if (reflection) {
+      const rawMode = reflection.mode ?? 'minimal';
+      mode = ALLOWED_MODES.has(rawMode) ? rawMode : 'minimal';
+      const thresholds = reflection.thresholds?.[mode];
+      if (thresholds) {
+        if (typeof thresholds.commit_threshold === 'number') {
+          commitThreshold = thresholds.commit_threshold;
+        }
+        if (typeof thresholds.days_threshold === 'number') {
+          daysThreshold = thresholds.days_threshold;
+        }
+        if (typeof thresholds.auto_generate === 'boolean') {
+          autoGenerate = thresholds.auto_generate;
+        }
+        if (typeof thresholds.prompt_user === 'boolean') {
+          promptUser = thresholds.prompt_user;
+        }
+      } else if (mode === 'full') {
+        commitThreshold = 10;
+        daysThreshold = 5;
+      }
+    }
+  } catch {
+    /* keep defaults */
+  }
+}
+
+if (mode === 'off') {
+  autoGenerate = false;
+  promptUser = false;
+}
+
+const config = {
+  mode,
+  commitThreshold,
+  daysThreshold,
+  autoGenerate,
+  promptUser,
+};
+
+if (process.argv.includes('--json')) {
+  console.log(JSON.stringify(config));
+  process.exit(0);
+}
+
+console.log(`MODE=${mode}`);
+console.log(`COMMIT_THRESHOLD=${commitThreshold}`);
+console.log(`DAYS_THRESHOLD=${daysThreshold}`);
+console.log(`AUTO_GENERATE=${autoGenerate}`);
+console.log(`PROMPT_USER=${promptUser}`);

package/scripts/node/postinstall.cjs

@@ -7,6 +7,7 @@ const {
   resolveConsumerTargetDir,
   isConsumerInstall,
 } = require("./install-bridges.cjs");
+const { applyConsumerGitignore } = require("./consumer-gitignore.cjs");
 
 function structuredLog(component, action, status, details) {
   const ts = new Date().toISOString();
@@ -39,12 +40,14 @@ if (fs.existsSync(agentsConsumer) && isConsumerInstall(resolvedPackage, resolved
   }
 }
 
-// Copy .gitignore.default → .gitignore (never overwrite existing)
-const gitignoreSource = path.join(packageRoot, ".gitignore.default");
-const gitignoreDest = path.join(targetDir, ".gitignore");
-if (!fs.existsSync(gitignoreDest) && isConsumerInstall(resolvedPackage, resolvedTarget)) {
-  fs.copyFileSync(gitignoreSource, gitignoreDest);
-  structuredLog("postinstall", "Created .gitignore from template", "info");
+// .gitignore: full template when absent; merge suit block when existing
+if (isConsumerInstall(resolvedPackage, resolvedTarget)) {
+  const gitignoreResult = applyConsumerGitignore(targetDir, packageRoot);
+  if (gitignoreResult === "created") {
+    structuredLog("postinstall", "Created .gitignore from template", "info");
+  } else if (gitignoreResult === "merged") {
+    structuredLog("postinstall", "Merged 0xray suit entries into .gitignore", "info");
+  }
 }
 
 // Unified 4-platform bridge install (OpenCode, Grok, Hermes, OpenClaw)

package/scripts/node/universal-version-manager.js

@@ -152,7 +152,7 @@ const OFFICIAL_VERSIONS = {
   framework: {
     version: PACKAGE_VERSION,
       displayName: "xray: Self-Healing AI Governance OS",
-      lastUpdated: "2026-06-17",
+      lastUpdated: "2026-06-19",
     // Counts (auto-calculated, but can be overridden)
     ...CALCULATED_COUNTS,
   },

package/src/integrations/grok/plugin/0xray/hooks/hooks.json

@@ -36,7 +36,8 @@
             "type": "command",
             "command": "node",
             "args": [
-              "${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js"
+              "${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js",
+              "--hook-event=user_prompt_submit"
             ],
             "timeout": 15000
           }

package/src/mcps/orchestrator/handlers/complexity-handler.ts

@@ -7,6 +7,7 @@
 import { frameworkLogger } from '../../../core/framework-logger.js';
 import {
   buildLeadDevPlan,
+  buildSynthesisCheckpointPlan,
   isLeadDevModeActive,
   persistLeadDevPlan,
 } from '../../../nucleus/autonomy-kernel.js';
@@ -67,9 +68,14 @@ export class ComplexityHandler {
    * Handle analyze-complexity request
    */
   async handleAnalyzeComplexity(
-    args: { tasks: AnalyzeComplexityInput[]; sessionId?: string },
+    args: {
+      tasks: AnalyzeComplexityInput[];
+      sessionId?: string;
+      synthesisCheckpoint?: boolean;
+      synthesisDueReason?: string | null;
+    },
     asideId?: string,
-  ): Promise<{ content: Array<{ type: string; text: string }> }> {
+  ): Promise<{ content: Array<{ type: string; text: string }>; ok: boolean }> {
     const tasks = normalizeAnalyzeTasks(args.tasks ?? []);
 
     await frameworkLogger.log(
@@ -92,8 +98,10 @@ export class ComplexityHandler {
       const planTaskInputs = tasks
         .filter((t) => t.description?.trim())
         .map((t) => ({ description: t.description, type: t.type }));
-      const leadDevPlan =
-        isLeadDevModeActive() && (primaryDescription || planTaskInputs.length > 0)
+      const synthesisCheckpoint = args.synthesisCheckpoint === true;
+      const leadDevPlan = synthesisCheckpoint
+        ? buildSynthesisCheckpointPlan(args.synthesisDueReason ?? null)
+        : isLeadDevModeActive() && (primaryDescription || planTaskInputs.length > 0)
           ? buildLeadDevPlan(
               primaryDescription,
               taskTypes.length ? taskTypes : ['implement'],
@@ -102,15 +110,20 @@ export class ComplexityHandler {
             )
           : null;
 
+      let planPersisted = synthesisCheckpoint ? leadDevPlan !== null : !leadDevPlan;
+
       if (leadDevPlan) {
         try {
           const sessionId = args.sessionId ?? `analyze-${Date.now()}`;
-          clearPendingDelegations();
+          if (!synthesisCheckpoint) {
+            clearPendingDelegations();
+          }
           const planPath = persistLeadDevPlan(leadDevPlan);
           const bound = bindPlanToSession(sessionId);
+          planPersisted = true;
           await frameworkLogger.log(
             'orchestrator.server',
-            'lead-dev-plan-persisted',
+            synthesisCheckpoint ? 'synthesis-plan-persisted' : 'lead-dev-plan-persisted',
             'info',
             {
               planPath,
@@ -118,19 +131,24 @@ export class ComplexityHandler {
               planGeneration: bound?.planGeneration,
               phaseCount: leadDevPlan.phases.length,
               todoCount: leadDevPlan.phases.reduce((n, p) => n + p.todos.length, 0),
+              synthesisCheckpoint,
             },
           );
         } catch (err) {
+          planPersisted = false;
           await frameworkLogger.log(
             'orchestrator.server',
-            'lead-dev-plan-persist-failed',
+            synthesisCheckpoint ? 'synthesis-plan-persist-failed' : 'lead-dev-plan-persist-failed',
             'warning',
             { error: err instanceof Error ? err.message : String(err) },
           );
         }
       }
 
+      const ok = planPersisted;
+
       return {
+        ok,
         content: [
           {
             type: 'text',
@@ -139,12 +157,14 @@ export class ComplexityHandler {
               recommendations,
               tasks.length,
               leadDevPlan,
+              synthesisCheckpoint,
             ),
           },
         ],
       };
     } catch (error) {
       return {
+        ok: false,
         content: [
           {
             type: 'text',
@@ -195,6 +215,7 @@ export class ComplexityHandler {
     recommendations: string[],
     taskCount: number,
     leadDevPlan: ReturnType<typeof buildLeadDevPlan> = null,
+    synthesisCheckpoint = false,
   ): string {
     const leadDevSection = leadDevPlan
       ? `
@@ -216,7 +237,11 @@ ${JSON.stringify(leadDevPlan, null, 2)}
 \`\`\``
       : '';
 
-    return `🔍 Complexity Analysis Results
+    const header = synthesisCheckpoint
+      ? '🔄 Synthesis Checkpoint — Reflect & Realign'
+      : '🔍 Complexity Analysis Results';
+
+    return `${header}
 
 **Tasks Analyzed:** ${taskCount}
 **Overall Complexity:** ${analysis.overallComplexity}/100

package/src/mcps/orchestrator/server.ts

@@ -140,10 +140,15 @@ export class OrchestratorServer {
           {
             name: 'analyze-complexity',
             description:
-              'Analyze task complexity and recommend orchestration strategy. When lead_dev_mode is on (features.json), includes phased plan + todos + subagent routes.',
+              'Analyze task complexity and recommend orchestration strategy. When lead_dev_mode is on (features.json), includes phased plan + todos + subagent routes. During synthesis checkpoint, returns collocated context and mandatory-consult realignment plan — pass sessionId from the active session.',
             inputSchema: {
               type: 'object',
               properties: {
+                sessionId: {
+                  type: 'string',
+                  description:
+                    'Active session id (required to clear synthesis checkpoint; inferred from checkpoint state when omitted)',
+                },
                 tasks: {
                   type: 'array',
                   items: {
@@ -276,12 +281,140 @@ export class OrchestratorServer {
             }
           }
           case 'analyze-complexity': {
-            const complexityArgs = args as { tasks: OrchestrationTask[] };
+            const complexityArgs = args as {
+              tasks: OrchestrationTask[];
+              sessionId?: string;
+            };
+            const projectRoot = process.cwd();
+            const {
+              isSynthesisCheckpointDue,
+              getSynthesisDueReason,
+              getSynthesisCheckpointSessionId,
+            } = await import('../../nucleus/synthesis.js');
+            const { appendSynthesisContextToResponse, prepareSynthesisCollocatedContext } =
+              await import('../../nucleus/synthesis-context.js');
+            const {
+              loadPersistedLeadDevPlan,
+              isSynthesisRealignmentPlan,
+              areSynthesisConsultTodosComplete,
+              getSynthesisConsultTodos,
+              getNextRequiredTodo,
+            } = await import('../../nucleus/lead-dev-plan-persistence.js');
+
+            const checkpointSession = getSynthesisCheckpointSessionId(projectRoot);
+            if (
+              checkpointSession &&
+              complexityArgs.sessionId &&
+              complexityArgs.sessionId !== checkpointSession
+            ) {
+              return {
+                content: [
+                  {
+                    type: 'text' as const,
+                    text:
+                      `❌ Synthesis sessionId mismatch — expected \`${checkpointSession}\` ` +
+                      `(from synthesis-checkpoint.json), got \`${complexityArgs.sessionId}\`.`,
+                  },
+                ],
+              };
+            }
+
+            const sessionId = checkpointSession ?? complexityArgs.sessionId ?? null;
+            const synthesisDue = checkpointSession
+              ? isSynthesisCheckpointDue(projectRoot, checkpointSession)
+              : false;
+            const dueReason = synthesisDue
+              ? getSynthesisDueReason(projectRoot, sessionId)
+              : null;
+
+            if (synthesisDue && !sessionId) {
+              return {
+                content: [
+                  {
+                    type: 'text' as const,
+                    text:
+                      '❌ Synthesis checkpoint due but sessionId could not be resolved. ' +
+                      'Pass sessionId matching .xray/state/synthesis-checkpoint.json.',
+                  },
+                ],
+              };
+            }
+
+            const existingPlan = loadPersistedLeadDevPlan(projectRoot);
+            const realignmentInProgress =
+              synthesisDue &&
+              existingPlan &&
+              isSynthesisRealignmentPlan(existingPlan) &&
+              !areSynthesisConsultTodosComplete(existingPlan);
+
+            if (realignmentInProgress) {
+              const collocated = await prepareSynthesisCollocatedContext(projectRoot, dueReason);
+              const nextTodo = getNextRequiredTodo(existingPlan);
+              const consultTodos = getSynthesisConsultTodos(existingPlan);
+              const todoList = consultTodos
+                .map(
+                  (t) =>
+                    `- [${t.status === 'completed' ? 'x' : ' '}] ${t.id} (${t.subagent}): ${t.task}`,
+                )
+                .join('\n');
+              let text =
+                '🔄 Synthesis realignment in progress — consult todos preserved (analyze-complexity no-op).\n\n' +
+                `**Next required todo:** ${nextTodo?.id ?? 'none'} (${nextTodo?.subagent ?? ''})\n\n` +
+                `${todoList}\n\n` +
+                'Complete mandatory consult todos via Task spawns before other gated work.';
+              if (collocated.collatedText) {
+                text = appendSynthesisContextToResponse(
+                  [{ type: 'text', text }],
+                  collocated.collatedText,
+                )[0]!.text;
+              }
+              return { content: [{ type: 'text' as const, text }] };
+            }
+
+            const collocated = synthesisDue
+              ? await prepareSynthesisCollocatedContext(projectRoot, dueReason)
+              : null;
+            const inheritedContext = synthesisDue && collocated
+              ? { synthesis: true, ...collocated }
+              : { taskCount: complexityArgs.tasks.length };
+
             const aside = await spawnAside({
-              description: `Complexity analysis: ${complexityArgs.tasks.length} tasks`,
+              description: synthesisDue
+                ? 'Synthesis checkpoint: reflect & realign'
+                : `Complexity analysis: ${complexityArgs.tasks.length} tasks`,
+              ...(sessionId ? { sessionId } : {}),
+              inheritedContext,
             });
             try {
-              return await this.complexityHandler.handleAnalyzeComplexity(complexityArgs, aside.asideId);
+              const result = await this.complexityHandler.handleAnalyzeComplexity(
+                {
+                  ...complexityArgs,
+                  ...(sessionId ? { sessionId } : {}),
+                  ...(synthesisDue
+                    ? { synthesisCheckpoint: true, synthesisDueReason: dueReason }
+                    : {}),
+                },
+                aside.asideId,
+              );
+
+              let content = result.content;
+              if (synthesisDue && collocated?.collatedText) {
+                content = appendSynthesisContextToResponse(content, collocated.collatedText);
+              }
+
+              if (synthesisDue && result.ok) {
+                content = content.map((block, index) =>
+                  index === 0
+                    ? {
+                        ...block,
+                        text:
+                          `${block.text}\n\n**Synthesis checkpoint remains active** until mandatory consult todos (s.1–s.3) are completed via Task spawns.`,
+                      }
+                    : block,
+                );
+              }
+
+              return { content };
             } finally {
               closeAside(aside.asideId);
             }
@@ -356,13 +489,51 @@ export class OrchestratorServer {
     skipApply?: boolean;
   }): Promise<{ content: Array<{ type: 'text'; text: string }> }> {
     try {
+      const projectRoot = process.cwd();
+      const {
+        isSynthesisCheckpointDue,
+        getSynthesisDueReason,
+        getSynthesisCheckpointSessionId,
+        recordExecutionSlice,
+      } = await import('../../nucleus/synthesis.js');
+      const {
+        loadPersistedLeadDevPlan,
+        isSynthesisRealignmentPlan,
+        areSynthesisConsultTodosComplete,
+      } = await import('../../nucleus/lead-dev-plan-persistence.js');
+
+      const checkpointSession = getSynthesisCheckpointSessionId(projectRoot);
+      const sessionId = checkpointSession ?? null;
+      if (sessionId && isSynthesisCheckpointDue(projectRoot, sessionId)) {
+        const dueReason = getSynthesisDueReason(projectRoot, sessionId);
+        const plan = loadPersistedLeadDevPlan(projectRoot);
+        const realignmentPending =
+          plan && isSynthesisRealignmentPlan(plan) && !areSynthesisConsultTodosComplete(plan);
+        return {
+          content: [{
+            type: 'text' as const,
+            text: JSON.stringify({
+              blocked: true,
+              gate: 'synthesis-checkpoint',
+              dueReason,
+              primitive: 'synthesis',
+              realignmentPending,
+              hint: realignmentPending
+                ? 'Complete mandatory consult todos (s.1–s.3) before govern-and-apply'
+                : 'Run analyze-complexity to reflect and realign before govern-and-apply',
+            }, null, 2),
+          }],
+        };
+      }
+
       const { InferenceCycle } = await import('../../inference/inference-cycle.js');
-      const cycle = InferenceCycle.getInstance(process.cwd(), {
+      const cycle = InferenceCycle.getInstance(projectRoot, {
         skipApply: args.skipApply ?? false,
       });
 
       const aside = await spawnAside({
         description: `Governance cycle: ${args.proposals.length} proposals`,
+        ...(sessionId ? { sessionId } : {}),
         priorVerdictContext: { proposalCount: args.proposals.length },
       });
 
@@ -377,12 +548,17 @@ export class OrchestratorServer {
       const approved = result!.votes.filter((v) => v.decision === 'approve').length;
       const rejected = result!.votes.length - approved;
 
+      if (sessionId) {
+        recordExecutionSlice('gate', { projectRoot, sessionId });
+      }
+
       return {
         content: [{
           type: 'text' as const,
           text: JSON.stringify({
             cycleId: result!.cycleId,
             asideId: aside.asideId,
+            synthesisBridged: Boolean(sessionId),
             approved,
             rejected,
             votes: result!.votes,