0xray 3.5.4 → 4.0.0

package/src/mcps/orchestrator/handlers/task-handler.ts

@@ -47,9 +47,108 @@ export class TaskHandler {
       sessionId?: string;
       executionMode?: string;
       timeout?: number;
+      confer?: boolean;
+      conferFixture?: boolean;
+      collocatedText?: string;
+      userAsideId?: string;
+      setActiveAside?: boolean;
+      clearActiveAside?: boolean;
     },
     deps: TaskHandlerDeps
   ): Promise<{ content: Array<{ type: string; text: string }> }> {
+    if (args.clearActiveAside === true) {
+      const projectRoot = process.cwd();
+      const { clearActiveAside, getActiveAsideId } = await import(
+        '../../../nucleus/user-aside.js',
+      );
+      const prior = getActiveAsideId(projectRoot, args.sessionId ?? null);
+      clearActiveAside(projectRoot);
+      return {
+        content: [
+          {
+            type: 'text',
+            text: prior
+              ? `✅ Cleared active aside \`${prior}\` — spawns resume main lead-dev plan.`
+              : 'ℹ️ No active aside was set.',
+          },
+        ],
+      };
+    }
+
+    if (args.userAsideId?.trim()) {
+      const projectRoot = process.cwd();
+      const {
+        setActiveAsideId,
+        loadUserAside,
+        formatUserAsideSummary,
+        isUserAsidesEnabled,
+        UserAsideValidationError,
+      } = await import('../../../nucleus/user-aside.js');
+      const { clearPendingDelegations } = await import(
+        '../../../nucleus/pending-delegations.js',
+      );
+      if (!isUserAsidesEnabled(projectRoot)) {
+        return {
+          content: [{ type: 'text', text: '❌ User asides disabled in features.json' }],
+        };
+      }
+      const asideId = args.userAsideId.trim();
+      const aside = loadUserAside(asideId, projectRoot);
+      if (!aside) {
+        return {
+          content: [
+            {
+              type: 'text',
+              text: `❌ User aside \`${asideId}\` not found — run analyze-complexity with userAsideId first.`,
+            },
+          ],
+        };
+      }
+      if (args.setActiveAside !== false) {
+        try {
+          clearPendingDelegations(projectRoot);
+          setActiveAsideId(asideId, projectRoot, args.sessionId ?? null);
+        } catch (err) {
+          const message = err instanceof UserAsideValidationError ? err.message : String(err);
+          return { content: [{ type: 'text', text: `❌ ${message}` }] };
+        }
+      }
+      return {
+        content: [
+          {
+            type: 'text',
+            text:
+              `✅ Active aside: \`${asideId}\`\n\n${formatUserAsideSummary(aside)}`,
+          },
+        ],
+      };
+    }
+
+    if (args.confer === true) {
+      const { runConferQuorum, formatConferQuorumReport, isConferEnabled } = await import(
+        '../../../nucleus/confer.js',
+      );
+      const sid = args.sessionId ?? `confer_${Date.now()}`;
+      if (!isConferEnabled()) {
+        return {
+          content: [{ type: 'text', text: '❌ Confer disabled in features.json' }],
+        };
+      }
+      const conferOpts: {
+        dueReason?: string | null;
+        fixture?: boolean;
+        collocatedText?: string;
+      } = {
+        dueReason: args.description,
+        fixture: args.conferFixture === true,
+      };
+      if (args.collocatedText) conferOpts.collocatedText = args.collocatedText;
+      const result = await runConferQuorum(process.cwd(), sid, conferOpts);
+      return {
+        content: [{ type: 'text', text: formatConferQuorumReport(result) }],
+      };
+    }
+
     const { description, tasks = [], sessionId = `session_${Date.now()}`, executionMode = 'optimized', timeout = 300000 } = args;
 
     await frameworkLogger.log(

package/src/mcps/orchestrator/server.ts

@@ -133,14 +133,39 @@ export class OrchestratorServer {
                   default: 'optimized',
                 },
                 timeout: { type: 'number', default: 300000 },
+                confer: {
+                  type: 'boolean',
+                  description:
+                    'Run mandatory 3-agent confer quorum (researcher, architect-tools, code-review) instead of task execution',
+                },
+                conferFixture: {
+                  type: 'boolean',
+                  description: 'Use fixture confer receipts (CI/verify)',
+                },
+                collocatedText: {
+                  type: 'string',
+                  description: 'Collocated synthesis context for confer prompts',
+                },
+                userAsideId: {
+                  type: 'string',
+                  description: 'Activate an existing user aside for spawn routing',
+                },
+                setActiveAside: {
+                  type: 'boolean',
+                  description: 'Set userAsideId as the active aside (default true)',
+                },
+                clearActiveAside: {
+                  type: 'boolean',
+                  description: 'Clear active aside — resume main lead-dev plan spawns',
+                },
               },
-              required: ['description', 'tasks'],
+              required: ['description'],
             },
           },
           {
             name: 'analyze-complexity',
             description:
-              'Analyze task complexity and recommend orchestration strategy. When lead_dev_mode is on (features.json), includes phased plan + todos + subagent routes. During synthesis checkpoint, returns collocated context and mandatory-consult realignment plan — pass sessionId from the active session.',
+              'Analyze task complexity and recommend orchestration strategy. When lead_dev_mode is on (features.json), includes phased plan + todos + subagent routes. Pass userAsideId to intake a parallel user aside ({asideId}.a.* namespaced todos, worktree-like). During synthesis checkpoint, returns collocated context and mandatory-consult realignment plan — pass sessionId from the active session.',
             inputSchema: {
               type: 'object',
               properties: {
@@ -149,6 +174,27 @@ export class OrchestratorServer {
                   description:
                     'Active session id (required to clear synthesis checkpoint; inferred from checkpoint state when omitted)',
                 },
+                userAsideId: {
+                  type: 'string',
+                  description:
+                    'User aside id — persists .xray/state/asides/{id}.json with {asideId}.a.* todos (parallel track)',
+                },
+                userAsideTitle: {
+                  type: 'string',
+                  description: 'Display title for the user aside (defaults to userAsideId)',
+                },
+                worktree: {
+                  type: 'string',
+                  description: 'Optional worktree path for aside isolation',
+                },
+                branch: {
+                  type: 'string',
+                  description: 'Optional git branch for the aside',
+                },
+                setActiveAside: {
+                  type: 'boolean',
+                  description: 'Activate aside for spawn routing (default true when userAsideId set)',
+                },
                 tasks: {
                   type: 'array',
                   items: {
@@ -391,7 +437,12 @@ export class OrchestratorServer {
                   ...complexityArgs,
                   ...(sessionId ? { sessionId } : {}),
                   ...(synthesisDue
-                    ? { synthesisCheckpoint: true, synthesisDueReason: dueReason }
+                    ? {
+                        synthesisCheckpoint: true,
+                        synthesisDueReason: dueReason,
+                        collocatedText: collocated?.collatedText ?? null,
+                        conferFixture: process.env.XRAY_CONFER_FIXTURE === '1',
+                      }
                     : {}),
                 },
                 aside.asideId,
@@ -402,13 +453,13 @@ export class OrchestratorServer {
                 content = appendSynthesisContextToResponse(content, collocated.collatedText);
               }
 
-              if (synthesisDue && result.ok) {
+              if (synthesisDue && result.ok && !result.content[0]?.text?.includes('Confer quorum')) {
                 content = content.map((block, index) =>
                   index === 0
                     ? {
                         ...block,
                         text:
-                          `${block.text}\n\n**Synthesis checkpoint remains active** until mandatory consult todos (s.1–s.3) are completed via Task spawns.`,
+                          `${block.text}\n\n**Confer** runs automatically at synthesis checkpoint (researcher → architect-tools → code-review). Checkpoint clears when all consult todos complete.`,
                       }
                     : block,
                 );

package/vendor/@0xray/repertoire/AGENTS.md

@@ -0,0 +1,163 @@
+# 0xRay AI Agents
+
+Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
+
+**v3.4.5** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
+
+## Postinstall (automatic)
+
+`npm install 0xray` runs `install-bridges.cjs` and:
+
+- Copies this file → **`AGENTS.md`** in your project root
+- Ships root **`SKILLS.md`** and syncs **45 skills** to platform skill directories
+- Seeds **`.gitignore`** (from template, if absent)
+- Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`)
+- Writes **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
+- Installs bridges: **OpenCode**, **Grok**, **Hermes**, **OpenClaw**
+
+Optional extras: `npx 0xray setup`
+
+## Available MCP Servers
+
+All seven servers use `npx -y 0xray mcp <cmd>` — configured in your project `.mcp.json`:
+
+| Server | Role |
+|--------|------|
+| `xray-governance` | Proposal governance, codex snapshot, quality gates |
+| `xray-skills` | Skill invocation, 45 knowledge skills |
+| `xray-orchestrator` | thinDispatch routing, AsideContext, confidence gate |
+| `xray-enforcer` | Codex compliance enforcement, rule validation |
+| `xray-researcher` | Codebase exploration, memory-routing enrichment |
+| `xray-code-review` | Proposal quality, code review deliberation |
+| `xray-architect-tools` | System design, architecture decisions |
+
+Governance deliberation uses **code-review**, **security-audit** (via enforcer/skills), and **researcher** within this 7-server surface.
+
+## CLI Commands
+
+| Command | Description |
+|---------|-------------|
+| `npx 0xray setup` | Symlinks, hook extras, Hermes skill sync |
+| `npx 0xray status` | Verify installation |
+| `npx 0xray opencode install` | OpenCode bridge (also runs on postinstall) |
+| `npx 0xray grok install` | Grok plugin + 7 MCPs servers + skill sync |
+| `npx 0xray hermes install` | Hermes plugin bridge |
+| `npx 0xray openclaw install` | OpenClaw config + skills |
+| `npx 0xray skill:install` | Install starter skills |
+| `npx 0xray validate` | Validate codex compliance |
+| `npx 0xray codex check` | Check codex rules |
+| `npx 0xray health` | Framework health check |
+| `npx 0xray mcp <server>` | Start an MCP server (stdio) |
+
+## Governance
+
+xray operates under the three-subsystem model: **Inference** + **External Governance** (Dynamo Solar SSOT) + **Autonomous Engine** (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
+
+**Codex**: `.xray/codex.json` — **68 terms** across all agent interactions.
+
+## thinDispatch Routing
+
+- Simple (≤15): Single agent
+- Moderate (≤25): Single agent with tools
+- Complex (≤50): Multi-agent coordination
+- Enterprise (>50): Orchestrator-led team
+
+## AsideContext (v3.2+)
+
+Bounded orchestrator subcontexts via `xray-orchestrator` MCP — `spawnAside` / `closeAside` on multi-step tasks. Repertoire memory routing (when enabled) flows through `inheritedContext.memoryRouting`.
+
+## Memory Routing + Repertoire (optional, v3.3+)
+
+Configure in `.xray/features.json`:
+
+```json
+"memory_routing": {
+  "enabled": true,
+  "provider": "repertoire",
+  "module_path": "../repertoire/dist/provider/memory-routing-provider.js",
+  "config": {
+    "signalsPath": "../repertoire/data/curated_signals.json"
+  }
+}
+```
+
+Without Repertoire: `{ "enabled": false, "provider": "null" }`.
+
+**External MCP** (Hermes/Grok): add Repertoire alongside 0xRay servers:
+
+```json
+"repertoire": {
+  "command": "npx",
+  "args": ["-y", "@0xray/repertoire", "mcp"]
+}
+```
+
+Tools: `repertoire__get_task_confidence`, `repertoire__get_high_confidence_signals`, `repertoire__search_primitives`, `repertoire__ingest_feedback`.
+
+## Codex OS (always on — not optional)
+
+The Universal Development Codex (`.xray/codex.json`, **69 terms**) is enforced by **PreToolUse** (blocks) and this section (brain). MCP enforcer is audit — not the gate.
+
+| Term | Rule | Enforcement |
+|------|------|-------------|
+| 11 | No `any`, `@ts-ignore`, `@ts-expect-error` | PreToolUse deny on edits |
+| 29 | Security by design — no `eval()` | PreToolUse deny |
+| 59 | Complex work → orchestrator intake | PreToolUse deny `spawn_subagent` without plan |
+| 67–68 | Best subagents + lead dev ownership | `analyze-complexity` + orchestrator skill |
+| **69** | **No new MCP/skill/handler surface** | PreToolUse deny new `*.server.ts`, `SKILL.md` |
+
+`features.json` → `multi_agent_orchestration.no_new_surface` (default **true**). Rewire existing hooks/MCPs/skills — do not add parallel APIs.
+
+## Default operating mode: lead dev (rewired — no new MCP)
+
+When the suit is worn, **lead dev mode** is ON via existing config + hooks:
+
+| Layer | Existing piece | Rewire |
+|-------|----------------|--------|
+| Config | `features.json` → `multi_agent_orchestration.lead_dev_mode` | Extended, not new block |
+| SessionStart + UserPromptSubmit | Grok hooks → `session-start.js` | Writes `.xray/state/session-boot.json` + `logs/framework/activity.log` |
+| **OS gate** | **PreToolUse hook** | Codex patterns, surface area, spawn gate — `{"decision":"deny"}` + activity.log |
+| Intake + plan | `xray-orchestrator` → **`analyze-complexity`** | Persists `.xray/state/lead-dev-plan.json` |
+| Test triage | PreToolUse hook | Per-suite hint on full `npm test` |
+| Playbook | **`orchestrator`** skill | Codex 59, 67–69 rules |
+
+**First substantive task:** `analyze-complexity` with `tasks` array — **required before** `spawn_subagent`. You are the **lead developer**. Users speak in goals, not keywords.
+
+| # | Rule |
+|---|------|
+| 1 | Phased plan + detailed todos; assign best subagent; monitor output |
+| 2 | Take the helm — loop test fix until complete; no permission pings |
+| 3 | Per-suite test triage after major changes; full suite last |
+| 4 | Lead stays main thread; subagents execute; update todos continuously |
+| 5 | Read all console and test output; triage fix rerun |
+| 6 | Never defer errors as "pre-existing" — add todo and resolve |
+| 7 | Resolve all errors before phase completion |
+
+**Major work:** invoke `researcher` + `architect-tools` + `code-review` before planning/refactors — automatically.
+
+## Skills
+
+Full catalog in root **`SKILLS.md`** (shipped on postinstall). **`orchestrator`** skill documents lead-dev mode. Invoke via `@orchestrator` or `xray-skills` MCP (`invoke-skill`, `list-skills`).
+
+## File Organization
+
+| File Type | Save To |
+|-----------|---------|
+| Reflections | `docs/reflections/` |
+| Logs | `logs/` |
+| Scripts | `scripts/` or `scripts/bash/` |
+| Test Files | `src/__tests__/` |
+| Source Code | `src/` |
+| Config | `config/` or `.xray/` |
+
+## Documentation
+
+| Topic | URL |
+|-------|-----|
+| Getting started | https://0xrayai.github.io/xray/docs/guides/getting-started |
+| Platform integrations | https://0xrayai.github.io/xray/docs/guides/integrations |
+| Features since 3.1 | https://0xrayai.github.io/xray/docs/guides/features-since-3.1 |
+| AsideContext | https://0xrayai.github.io/xray/docs/guides/aside-context |
+| Memory routing | https://0xrayai.github.io/xray/docs/guides/memory-routing |
+| Repertoire | https://0xrayai.github.io/xray/docs/guides/repertoire |
+| Autonomy command | https://0xrayai.github.io/xray/docs/guides/autonomy-command |

package/vendor/@0xray/repertoire/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 0xRay Framework Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/@0xray/repertoire/README.md

@@ -0,0 +1,120 @@
+# @0xray/repertoire
+
+Factory memory organ for [0xRay](https://github.com/0xRayAI/xray): seed primitives, in-process memory routing, extra MCP (not an 8th `xray-*` server).
+
+**v0.2.0** · 0xRay **4.0** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
+
+## Install
+
+```bash
+npm install @0xray/repertoire
+```
+
+Does not install `0xray`. After 0xray wear, refresh Grok hooks:
+
+```bash
+npx 0xray grok install --force
+```
+
+Restart Grok MCP sessions — hooks do not hot-reload.
+
+## Suit + autonomy (Grok Build)
+
+```bash
+npm run confirm:suit    # post-reboot: Layer 1 + 2a + 2b checklist
+```
+
+**Suit verify from any consumer** (project must have `.xray/` + `0xray` installed):
+
+```bash
+npx repertoire-verify-suit    # 30-check harness from any consumer project root
+```
+
+Includes 3.5.0 delegation gate + PostToolUse assertions (steps 11–13). Full harness: clone this repo and `npm run confirm:suit`. Quick check: `npx 0xray health`.
+
+Default operating model: **`autonomy-command`** — lead dev, phased todos, subagent dispatch, per-suite test triage. See [AGENTS.md](AGENTS.md) and [xray autonomy guide](https://0xrayai.github.io/xray/docs/guides/autonomy-command).
+
+## MCP server (Hermes, Grok, OpenCode)
+
+```json
+"repertoire": {
+  "command": "npx",
+  "args": ["-y", "@0xray/repertoire", "mcp"]
+}
+```
+
+Bundled `data/curated_signals.json` is used by default. Override with env:
+
+| Env | Default |
+|-----|---------|
+| `CURATED_SIGNALS_PATH` | `<package>/data/curated_signals.json` |
+| `REPERTOIRE_DATA_DIR` | `<package>/data` |
+| `REPERTOIRE_LOG_DIR` | `<package>/logs/groover-inference` |
+
+### Tools
+
+| Tool | Purpose |
+|------|---------|
+| `repertoire__get_task_confidence` | Trap detection, complexity boost, `recommendedAgent` |
+| `repertoire__search_primitives` | Text search against curated signals |
+| `repertoire__get_high_confidence_signals` | Validated signals above threshold |
+| `repertoire__ingest_feedback` | Record orchestrator outcomes |
+
+## 0xRay memory routing (in-process)
+
+In `.xray/features.json` or `xray/features.json`:
+
+```json
+"memory_routing": {
+  "enabled": true,
+  "provider": "repertoire",
+  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js"
+}
+```
+
+`config` is optional when using the bundled registry. For a project-local registry:
+
+```json
+"config": {
+  "signalsPath": ".xray/curated_signals.json",
+  "logDir": "logs/groover-inference"
+}
+```
+
+Paths in `config` resolve relative to the consumer project root.
+
+## Programmatic import
+
+```ts
+import { createMemoryRoutingProvider } from '@0xray/repertoire/provider/memory-routing-provider';
+
+const provider = createMemoryRoutingProvider();
+provider.getTaskConfidence?.({
+  id: 'task-1',
+  description: 'TYPE: ontological-trap attestation-as-map',
+  type: 'governance',
+});
+```
+
+## Field actuation add-ons (optional)
+
+Repertoire has **no Moltbook dependency**. It ingests **enriched JSONL** from any producer (`matched_primitives` + `match_confidence`) and closes the memory loop via consult, feedback, and post-tick ingest.
+
+Each project activates its own public field surface if it wants one:
+
+| Layer | Required? | Example |
+|-------|-----------|---------|
+| Repertoire + 0xRay memory routing | Core suit | `npm install @0xray/repertoire`, `features.json` |
+| Engage pipeline (`consult → govern → log`) | Per producer | `groover/deploy/engage-core.ts` |
+| Moltbook (or other social API) | **Add-on** | Groover's `deploy/moltbook-*.ts` + `MOLTBOOK_API_KEY` |
+
+Jelly, ZigZag, or a custom cron worker can wire the same loop without Moltbook — point `logDir` at your JSONL and set `REPERTOIRE_ROOT`.
+
+## Sibling-repo development
+
+```bash
+git clone https://github.com/0xRayAI/repertoire
+cd repertoire && npm install && npm run build && npm test
+```
+
+See [AGENTS.md](./AGENTS.md) for stack integration details.