0xray 3.5.2 → 3.5.3

package/AGENTS-consumer.md

@@ -4,7 +4,7 @@
 
 Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
 
-**v3.5.2** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
+**v3.5.3** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
 
 ## Postinstall (automatic)
 

package/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.5.2**).
+Quick reference for the xray AI orchestration framework (**v3.5.3**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/README.md

@@ -1,6 +1,6 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.5.2** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.5.3** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
 
 ## Your AI Power Suit
 

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.5.2** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.5.3** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.5.2**).
+Quick reference for the xray AI orchestration framework (**v3.5.3**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/dist/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.5.3] - 2026-06-19
+
+### 🔄 Changes
+
+### 🔎 Other Changes
+- fix(release): ship verify-grok-synthesis-gate.mjs in npm tarball (c2d32627e)
+
+---
+
 ## [3.5.2] - 2026-06-19
 
 ### 🐛 Bug Fixes

package/dist/README.md

@@ -1,6 +1,6 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.5.2** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.5.3** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
 
 ## Your AI Power Suit
 

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.5.2** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.5.3** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -147,6 +147,7 @@
     "scripts/mjs/validate-postinstall-config.mjs",
     "scripts/mjs/verify-orchestrator-behavior.mjs",
     "scripts/mjs/verify-grok-delegation-gate.mjs",
+    "scripts/mjs/verify-grok-synthesis-gate.mjs",
     "scripts/mjs/verify-hermes-delegation-gate.mjs",
     "scripts/mjs/verify-delegation-gate-core.mjs",
     "scripts/mjs/delegation-gate-fixture.mjs",

package/scripts/mjs/verify-grok-synthesis-gate.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * Hook fixture verify — PreToolUse synthesis gate via live Grok hook path.
+ * Run: node scripts/mjs/verify-grok-synthesis-gate.mjs
+ */
+import { execSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  SYNTHESIS_FIXTURE_SESSION_ID,
+  seedSynthesisDueFixture,
+} from './delegation-gate-fixture.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+const preToolHook = join(packageRoot, 'dist/integrations/grok/hooks/pre-tool-use.js');
+
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+function runHook(fixture, env = {}) {
+  const payload = JSON.stringify(fixture);
+  const out = execSync(`printf '%s' '${payload.replace(/'/g, "'\\''")}' | node "${preToolHook}"`, {
+    encoding: 'utf8',
+    env: { ...process.env, ...env },
+  });
+  return JSON.parse(out.trim());
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-synth-grok-'));
+seedSynthesisDueFixture(tmp);
+
+const baseEnv = {
+  GROK_WORKSPACE_ROOT: tmp,
+  GROK_SESSION_ID: SYNTHESIS_FIXTURE_SESSION_ID,
+};
+
+try {
+  const denyWrite = runHook(
+    {
+      toolName: 'search_replace',
+      workspaceRoot: tmp,
+      sessionId: SYNTHESIS_FIXTURE_SESSION_ID,
+      toolInput: { path: 'src/a.ts', new_string: 'x' },
+    },
+    baseEnv,
+  );
+  if (denyWrite.decision === 'deny' && denyWrite.gate === 'synthesis-checkpoint') {
+    pass('PreToolUse denies write when synthesis due');
+  } else {
+    fail('synthesis write deny', JSON.stringify(denyWrite));
+  }
+
+  const allowRead = runHook(
+    {
+      toolName: 'read_file',
+      workspaceRoot: tmp,
+      sessionId: SYNTHESIS_FIXTURE_SESSION_ID,
+      toolInput: { path: 'src/a.ts' },
+    },
+    baseEnv,
+  );
+  if (allowRead.decision === 'allow') pass('PreToolUse allows read when synthesis due');
+  else fail('synthesis read allow', JSON.stringify(allowRead));
+
+  const allowConsult = runHook(
+    {
+      toolName: 'CallMcpTool',
+      workspaceRoot: tmp,
+      sessionId: SYNTHESIS_FIXTURE_SESSION_ID,
+      toolInput: {
+        server: 'xray-orchestrator',
+        toolName: 'analyze-complexity',
+        arguments: { tasks: [{ description: 'synthesis reflect', type: 'plan' }] },
+      },
+    },
+    baseEnv,
+  );
+  if (allowConsult.decision === 'allow') {
+    pass('PreToolUse allows analyze-complexity consult when synthesis due');
+  } else {
+    fail('synthesis consult allow', JSON.stringify(allowConsult));
+  }
+
+  const denyGovern = runHook(
+    {
+      toolName: 'CallMcpTool',
+      workspaceRoot: tmp,
+      sessionId: SYNTHESIS_FIXTURE_SESSION_ID,
+      toolInput: {
+        server: 'xray-orchestrator',
+        toolName: 'govern-and-apply',
+        arguments: { proposal: 'test' },
+      },
+    },
+    baseEnv,
+  );
+  if (denyGovern.decision === 'deny' && denyGovern.gate === 'synthesis-checkpoint') {
+    pass('PreToolUse denies govern-and-apply when synthesis due');
+  } else {
+    fail('synthesis govern deny', JSON.stringify(denyGovern));
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+console.log(
+  '\n' +
+    (failed === 0
+      ? '🎉 Grok synthesis gate verify passed (4/4).'
+      : `⚠️  ${failed} synthesis gate check(s) failed.`),
+);
+process.exit(failed === 0 ? 0 : 1);