0xray 3.5.4 → 4.0.0

package/dist/nucleus/aside-worktree.js

@@ -0,0 +1,164 @@
+/**
+ * User-aside worktree path resolution, spawn cwd validation, optional git provision.
+ */
+import { execFileSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { isUserAsidesEnabled } from './user-aside.js';
+export function normalizeWorktreePath(worktree, projectRoot) {
+    const trimmed = worktree.trim().replace(/\/$/, '');
+    const resolved = path.isAbsolute(trimmed) ? trimmed : path.resolve(projectRoot, trimmed);
+    return resolved.replace(/\/$/, '');
+}
+export function isAutoProvisionWorktreeEnabled(projectRoot = process.cwd()) {
+    if (!isUserAsidesEnabled(projectRoot))
+        return false;
+    const featuresPath = path.join(projectRoot, '.xray', 'features.json');
+    if (!fs.existsSync(featuresPath))
+        return false;
+    try {
+        const data = JSON.parse(fs.readFileSync(featuresPath, 'utf8'));
+        const raw = data.multi_agent_orchestration?.user_asides;
+        if (raw?.enabled === false)
+            return false;
+        return raw?.auto_provision_worktree === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Extract spawn cwd from host Task / spawn_subagent tool input. */
+export function extractSpawnCwd(toolInput, projectRoot) {
+    const isolation = toolInput.isolation ?? toolInput.isolation_mode;
+    if (isolation === 'worktree' || isolation === 'git_worktree') {
+        const wt = toolInput.worktree_path ??
+            toolInput.worktreePath ??
+            toolInput.worktree ??
+            toolInput.cwd ??
+            toolInput.working_directory ??
+            toolInput.workingDirectory;
+        if (wt != null && String(wt).trim() !== '') {
+            return normalizeWorktreePath(String(wt), projectRoot);
+        }
+    }
+    const raw = toolInput.cwd ??
+        toolInput.working_directory ??
+        toolInput.workingDirectory;
+    if (raw == null || String(raw).trim() === '')
+        return null;
+    return normalizeWorktreePath(String(raw), projectRoot);
+}
+export function validateAsideWorktreeCwd(worktree, toolInput, projectRoot) {
+    if (!worktree?.trim())
+        return { valid: true };
+    const expected = normalizeWorktreePath(worktree, projectRoot);
+    const projectNorm = path.resolve(projectRoot).replace(/\/$/, '');
+    if (projectNorm === expected || projectNorm.startsWith(`${expected}/`)) {
+        return { valid: true };
+    }
+    const spawnCwd = extractSpawnCwd(toolInput, projectRoot);
+    if (!spawnCwd) {
+        return {
+            valid: false,
+            gate: 'aside-worktree-cwd-missing',
+            reason: `Aside worktree is ${expected} but project root is ${projectNorm} — ` +
+                'spawn must set cwd / working_directory / isolation:worktree to the aside worktree',
+            hint: {
+                worktree: expected,
+                projectRoot: projectNorm,
+                required: ['cwd', 'working_directory', 'isolation:worktree'],
+            },
+        };
+    }
+    if (spawnCwd !== expected && !spawnCwd.startsWith(`${expected}/`)) {
+        return {
+            valid: false,
+            gate: 'aside-worktree-cwd-mismatch',
+            reason: `Spawn cwd ${spawnCwd} does not match aside worktree ${expected}`,
+            hint: { worktree: expected, spawnCwd, projectRoot: projectNorm },
+        };
+    }
+    return { valid: true };
+}
+function gitBranchExists(projectRoot, branch) {
+    try {
+        execFileSync('git', ['rev-parse', '--verify', branch], {
+            cwd: projectRoot,
+            stdio: 'pipe',
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolvePathForCompare(p) {
+    try {
+        return fs.realpathSync.native(p).replace(/\/$/, '');
+    }
+    catch {
+        return path.resolve(p).replace(/\/$/, '');
+    }
+}
+function isGitWorktreePath(wtPath, projectRoot) {
+    try {
+        const out = execFileSync('git', ['worktree', 'list', '--porcelain'], {
+            cwd: projectRoot,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const normalized = resolvePathForCompare(wtPath);
+        return out.split('\n').some((line) => {
+            if (!line.startsWith('worktree '))
+                return false;
+            const listed = line.slice('worktree '.length).trim();
+            return resolvePathForCompare(listed) === normalized;
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Guarded `git worktree add` when auto_provision_worktree is enabled.
+ * Creates branch with -b when it does not exist locally.
+ */
+export function provisionGitWorktree(opts) {
+    const wtPath = normalizeWorktreePath(opts.worktree, opts.projectRoot);
+    const branch = opts.branch.trim();
+    if (!branch) {
+        return { ok: false, path: wtPath, created: false, message: 'branch is required' };
+    }
+    if (fs.existsSync(wtPath)) {
+        if (isGitWorktreePath(wtPath, opts.projectRoot)) {
+            return { ok: true, path: wtPath, created: false, message: 'worktree already exists' };
+        }
+        return {
+            ok: false,
+            path: wtPath,
+            created: false,
+            message: `path exists but is not a git worktree: ${wtPath}`,
+        };
+    }
+    const gitDir = path.join(opts.projectRoot, '.git');
+    if (!fs.existsSync(gitDir)) {
+        return {
+            ok: false,
+            path: wtPath,
+            created: false,
+            message: `not a git repository: ${opts.projectRoot}`,
+        };
+    }
+    const branchExists = gitBranchExists(opts.projectRoot, branch);
+    const args = branchExists
+        ? ['worktree', 'add', wtPath, branch]
+        : ['worktree', 'add', '-b', branch, wtPath];
+    try {
+        execFileSync('git', args, { cwd: opts.projectRoot, stdio: 'pipe' });
+        return { ok: true, path: wtPath, created: true, message: 'worktree provisioned' };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, path: wtPath, created: false, message };
+    }
+}

package/dist/nucleus/autonomy-kernel.d.ts

@@ -43,8 +43,8 @@ export declare function isLeadDevModeActive(): boolean;
 export declare function routeSubagent(taskType: string): SubagentRoute;
 export declare function shouldFlagFullTestSuite(command: string): boolean;
 /** Mandatory-consult plan for synthesis checkpoint realignment (no implementation phase). */
-export declare function buildSynthesisCheckpointPlan(dueReason: string | null): LeadDevPlan | null;
-export declare function buildLeadDevPlan(description: string, taskTypes?: string[], taskInputs?: LeadDevPlanTaskInput[], mcpOverallComplexity?: number): LeadDevPlan | null;
+export declare function buildSynthesisCheckpointPlan(dueReason: string | null, projectRoot?: string): LeadDevPlan | null;
+export declare function buildLeadDevPlan(description: string, taskTypes?: string[], taskInputs?: LeadDevPlanTaskInput[], mcpOverallComplexity?: number, projectRoot?: string): LeadDevPlan | null;
 export declare function buildSessionBootContext(): Record<string, unknown>;
 /** Persist plan for PreToolUse spawn_subagent gate */
 export declare function persistLeadDevPlan(plan: LeadDevPlan, projectRoot?: string): string;

package/dist/nucleus/autonomy-kernel.js

@@ -6,6 +6,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { featuresConfigLoader } from '../core/features-config.js';
 import { scoreComplexity } from './thin-dispatch.js';
+import { conferDefaultForProfile, resolveRuntimeSuitProfile } from './suit-temperament.js';
 export const LEAD_DEV_RULES = [
     'Phased plan + detailed todos; assign best subagent; monitor output; iterate fully',
     'Lead dev takes helm — loop test fix until complete; no permission pings',
@@ -75,11 +76,17 @@ function buildImplementationTodos(description, taskTypes, taskInputs, idPrefix)
     }));
 }
 /** Mandatory-consult plan for synthesis checkpoint realignment (no implementation phase). */
-export function buildSynthesisCheckpointPlan(dueReason) {
+export function buildSynthesisCheckpointPlan(dueReason, projectRoot = process.cwd()) {
     if (!isLeadDevModeActive())
         return null;
     const cfg = orchestrationConfig();
-    const mandatoryConsults = cfg.auto_consult_major_work !== false ? [...MANDATORY_MAJOR_CONSULTS] : [];
+    const profile = resolveRuntimeSuitProfile(projectRoot);
+    const autoConsult = profile === 'frontier'
+        ? cfg.confer?.enabled === true || cfg.confer_on_synthesis === true
+        : profile === 'strict'
+            ? true
+            : cfg.auto_consult_major_work !== false;
+    const mandatoryConsults = autoConsult ? [...MANDATORY_MAJOR_CONSULTS] : [];
     if (mandatoryConsults.length === 0)
         return null;
     const reasonSuffix = dueReason ? ` (${dueReason})` : '';
@@ -113,10 +120,11 @@ export function buildSynthesisCheckpointPlan(dueReason) {
         },
     };
 }
-export function buildLeadDevPlan(description, taskTypes = ['implement'], taskInputs = [], mcpOverallComplexity) {
+export function buildLeadDevPlan(description, taskTypes = ['implement'], taskInputs = [], mcpOverallComplexity, projectRoot = process.cwd()) {
     if (!isLeadDevModeActive())
         return null;
     const cfg = orchestrationConfig();
+    const profile = resolveRuntimeSuitProfile(projectRoot);
     const threshold = cfg.phased_plan_threshold ?? 25;
     const score = scoreComplexity(description, { taskTypes });
     const mcpScore = mcpOverallComplexity !== undefined && Number.isFinite(mcpOverallComplexity)
@@ -124,9 +132,12 @@ export function buildLeadDevPlan(description, taskTypes = ['implement'], taskInp
         : 0;
     const complexity = Math.max(score.score, mcpScore);
     const requiresPhasedPlan = complexity > threshold || taskInputs.length > 1;
-    const mandatoryConsults = cfg.auto_consult_major_work !== false && requiresPhasedPlan
-        ? [...MANDATORY_MAJOR_CONSULTS]
-        : [];
+    const autoConsult = profile === 'frontier'
+        ? cfg.confer?.enabled === true || cfg.confer_on_synthesis === true
+        : profile === 'strict' || conferDefaultForProfile(profile)
+            ? cfg.auto_consult_major_work !== false
+            : false;
+    const mandatoryConsults = autoConsult && requiresPhasedPlan ? [...MANDATORY_MAJOR_CONSULTS] : [];
     const phases = requiresPhasedPlan
         ? [
             {

package/dist/nucleus/confer.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Confer — mandatory 3-agent quorum SSOT (researcher / architect-tools / code-review).
+ * Triggered automatically at synthesis checkpoint; records consult receipts + plan todos.
+ */
+import { type SynthesisConsultReceipt } from './synthesis-consult-receipt.js';
+export declare const CONFER_AGENTS: readonly ["researcher", "architect-tools", "code-review"];
+export interface ConferConfig {
+    enabled: boolean;
+    on_synthesis: boolean;
+}
+export interface ConferCheckpointState {
+    version: 1;
+    sessionId: string;
+    triggeredAt: string;
+    dueReason: string | null;
+    status: 'pending' | 'in_progress' | 'completed' | 'failed';
+    completedAgents: string[];
+    lastError?: string;
+}
+export interface ConferAgentResult {
+    todoId: string;
+    subagent: string;
+    outputText: string;
+    receiptRecorded: boolean;
+    todoCompleted: boolean;
+    verdict: SynthesisConsultReceipt['verdict'] | null;
+    error?: string;
+}
+export interface ConferQuorumResult {
+    status: 'completed' | 'partial' | 'skipped' | 'failed';
+    agents: ConferAgentResult[];
+    message: string;
+}
+export declare function conferCheckpointPath(projectRoot?: string): string;
+export declare function defaultConferConfig(): ConferConfig;
+export declare function loadConferConfig(projectRoot?: string): ConferConfig;
+export declare function isConferEnabled(projectRoot?: string): boolean;
+export declare function loadConferCheckpoint(projectRoot?: string): ConferCheckpointState | null;
+export declare function saveConferCheckpoint(state: ConferCheckpointState, projectRoot?: string): string;
+export declare function triggerConferCheckpoint(sessionId: string, dueReason: string | null, projectRoot?: string): ConferCheckpointState;
+export declare function isConferPending(projectRoot?: string, sessionId?: string | null): boolean;
+export declare function buildConferPrompt(subagent: string, todoTask: string, collocatedText: string, dueReason: string | null): string;
+/** Map confer subagent → MCP server + tool. */
+export declare function conferAgentMcpTarget(subagent: string): {
+    server: string;
+    tool: string;
+    args: (prompt: string, projectRoot: string) => Record<string, unknown>;
+};
+export declare function invokeConferAgent(subagent: string, prompt: string, projectRoot?: string): Promise<string>;
+export declare function applyConferConsultResult(todoId: string, subagent: string, sessionId: string, outputText: string, projectRoot?: string): ConferAgentResult;
+export declare function writeFixtureConferReceipt(todoId: string, subagent: string, sessionId: string, projectRoot?: string): ConferAgentResult;
+export declare function runConferQuorum(projectRoot: string | undefined, sessionId: string, options?: {
+    collocatedText?: string;
+    dueReason?: string | null;
+    fixture?: boolean;
+}): Promise<ConferQuorumResult>;
+export declare function formatConferQuorumReport(result: ConferQuorumResult): string;

package/dist/nucleus/confer.js

@@ -0,0 +1,322 @@
+/**
+ * Confer — mandatory 3-agent quorum SSOT (researcher / architect-tools / code-review).
+ * Triggered automatically at synthesis checkpoint; records consult receipts + plan todos.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { MANDATORY_MAJOR_CONSULTS } from './autonomy-kernel.js';
+import { areSynthesisConsultTodosComplete, getNextRequiredTodo, getSynthesisConsultTodos, isSynthesisRealignmentPlan, loadPersistedLeadDevPlan, updatePlanTodoStatus, } from './lead-dev-plan-persistence.js';
+import { buildReceiptFromConsultOutput, tryRecordSynthesisConsultReceipt, parseConsultVerdictFromText, } from './synthesis-consult-receipt.js';
+import { isSynthesisCheckpointDue } from './synthesis.js';
+import { conferDefaultForProfile, resolveRuntimeSuitProfile } from './suit-temperament.js';
+export const CONFER_AGENTS = [...MANDATORY_MAJOR_CONSULTS];
+const STATE_VERSION = 1;
+export function conferCheckpointPath(projectRoot = process.cwd()) {
+    return path.join(projectRoot, '.xray', 'state', 'confer-checkpoint.json');
+}
+export function defaultConferConfig() {
+    return { enabled: true, on_synthesis: true };
+}
+export function loadConferConfig(projectRoot = process.cwd()) {
+    const featuresPath = path.join(projectRoot, '.xray', 'features.json');
+    const profile = resolveRuntimeSuitProfile(projectRoot);
+    if (profile === 'strict') {
+        return { enabled: true, on_synthesis: true };
+    }
+    if (!fs.existsSync(featuresPath)) {
+        return conferDefaultForProfile(profile)
+            ? defaultConferConfig()
+            : { enabled: false, on_synthesis: false };
+    }
+    try {
+        const data = JSON.parse(fs.readFileSync(featuresPath, 'utf8'));
+        const orch = data.multi_agent_orchestration ?? {};
+        const raw = orch.confer ?? {};
+        if (profile === 'frontier') {
+            const optedIn = raw.enabled === true || orch.confer_on_synthesis === true;
+            return { enabled: optedIn, on_synthesis: optedIn };
+        }
+        return {
+            enabled: raw.enabled !== false && orch.confer_on_synthesis !== false,
+            on_synthesis: raw.on_synthesis !== false && orch.confer_on_synthesis !== false,
+        };
+    }
+    catch {
+        return conferDefaultForProfile(profile)
+            ? defaultConferConfig()
+            : { enabled: false, on_synthesis: false };
+    }
+}
+export function isConferEnabled(projectRoot = process.cwd()) {
+    return loadConferConfig(projectRoot).enabled;
+}
+export function loadConferCheckpoint(projectRoot = process.cwd()) {
+    const statePath = conferCheckpointPath(projectRoot);
+    if (!fs.existsSync(statePath))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(statePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveConferCheckpoint(state, projectRoot = process.cwd()) {
+    const statePath = conferCheckpointPath(projectRoot);
+    fs.mkdirSync(path.dirname(statePath), { recursive: true });
+    fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
+    return statePath;
+}
+export function triggerConferCheckpoint(sessionId, dueReason, projectRoot = process.cwd()) {
+    const state = {
+        version: STATE_VERSION,
+        sessionId,
+        triggeredAt: new Date().toISOString(),
+        dueReason,
+        status: 'pending',
+        completedAgents: [],
+    };
+    saveConferCheckpoint(state, projectRoot);
+    return state;
+}
+export function isConferPending(projectRoot = process.cwd(), sessionId) {
+    const plan = loadPersistedLeadDevPlan(projectRoot);
+    if (!plan || !isSynthesisRealignmentPlan(plan))
+        return false;
+    if (areSynthesisConsultTodosComplete(plan))
+        return false;
+    if (sessionId && isSynthesisCheckpointDue(projectRoot, sessionId))
+        return true;
+    const state = loadConferCheckpoint(projectRoot);
+    if (!state || state.status === 'completed')
+        return false;
+    if (sessionId && state.sessionId !== sessionId)
+        return false;
+    return true;
+}
+export function buildConferPrompt(subagent, todoTask, collocatedText, dueReason) {
+    const reasonLine = dueReason ? `Due: ${dueReason}\n\n` : '';
+    return `${reasonLine}## Confer quorum — ${subagent}
+
+${todoTask}
+
+Review the collocated synthesis context and return a structured verdict.
+
+**Required in your response:**
+- Verdict: PASS | CONDITIONAL | FAIL
+- Top risks (bulleted)
+- Hardening note / recommendations
+
+---
+
+${collocatedText}`;
+}
+/** Map confer subagent → MCP server + tool. */
+export function conferAgentMcpTarget(subagent) {
+    switch (subagent) {
+        case 'architect-tools':
+            return {
+                server: 'architect-tools',
+                tool: 'architecture-assessment',
+                args: (prompt, projectRoot) => ({
+                    projectRoot,
+                    assessmentType: 'comprehensive',
+                    focusMetrics: ['complexity', 'coupling', 'cohesion', 'testability', 'scalability'],
+                    conferPrompt: prompt,
+                }),
+            };
+        case 'researcher':
+            return {
+                server: 'researcher',
+                tool: 'analyze_proposal',
+                args: (prompt) => ({
+                    proposalTitle: 'Synthesis confer — researcher',
+                    proposalDescription: prompt,
+                    proposalType: 'synthesis-confer',
+                    evidence: [],
+                }),
+            };
+        case 'code-review':
+        default:
+            return {
+                server: 'code-review',
+                tool: 'analyze_proposal',
+                args: (prompt) => ({
+                    proposalTitle: 'Synthesis confer — code-review',
+                    proposalDescription: prompt,
+                    proposalType: 'synthesis-confer',
+                    evidence: [],
+                }),
+            };
+    }
+}
+function extractMcpText(result) {
+    const content = result?.content;
+    if (Array.isArray(content)) {
+        return content.map((c) => c.text ?? '').join('\n');
+    }
+    if (typeof result === 'string')
+        return result;
+    try {
+        return JSON.stringify(result);
+    }
+    catch {
+        return String(result);
+    }
+}
+export async function invokeConferAgent(subagent, prompt, projectRoot = process.cwd()) {
+    const { mcpClientManager } = await import('../mcps/mcp-client.js');
+    const target = conferAgentMcpTarget(subagent);
+    const args = target.args(prompt, projectRoot);
+    const result = await mcpClientManager.callServerTool(target.server, target.tool, args);
+    const text = extractMcpText(result);
+    if (!text.trim()) {
+        throw new Error(`Empty confer response from ${subagent}`);
+    }
+    if (!parseConsultVerdictFromText(text)) {
+        throw new Error(`Confer response from ${subagent} missing parseable verdict (expected Verdict: PASS|CONDITIONAL|FAIL or DECISION: approve|reject|abstain)`);
+    }
+    return text;
+}
+export function applyConferConsultResult(todoId, subagent, sessionId, outputText, projectRoot = process.cwd()) {
+    const receipt = tryRecordSynthesisConsultReceipt(todoId, subagent, sessionId, outputText, projectRoot);
+    let todoCompleted = false;
+    if (receipt && receipt.verdict !== 'FAIL') {
+        todoCompleted = updatePlanTodoStatus(todoId, 'completed', projectRoot);
+    }
+    return {
+        todoId,
+        subagent,
+        outputText,
+        receiptRecorded: receipt != null,
+        todoCompleted,
+        verdict: receipt?.verdict ?? buildReceiptFromConsultOutput(todoId, subagent, sessionId, outputText)?.verdict ?? null,
+    };
+}
+export function writeFixtureConferReceipt(todoId, subagent, sessionId, projectRoot = process.cwd()) {
+    const output = `Verdict: PASS\nTop risks: none\nHardening: confer fixture quorum for ${subagent}`;
+    return applyConferConsultResult(todoId, subagent, sessionId, output, projectRoot);
+}
+export async function runConferQuorum(projectRoot = process.cwd(), sessionId, options = {}) {
+    const cfg = loadConferConfig(projectRoot);
+    if (!cfg.enabled || !cfg.on_synthesis) {
+        return {
+            status: 'skipped',
+            agents: [],
+            message: 'Confer disabled in features.json',
+        };
+    }
+    const plan = loadPersistedLeadDevPlan(projectRoot);
+    if (!plan || !isSynthesisRealignmentPlan(plan)) {
+        return {
+            status: 'skipped',
+            agents: [],
+            message: 'No synthesis realignment plan — confer not applicable',
+        };
+    }
+    if (areSynthesisConsultTodosComplete(plan)) {
+        return {
+            status: 'completed',
+            agents: [],
+            message: 'Confer already complete — all consult todos finished',
+        };
+    }
+    const state = triggerConferCheckpoint(sessionId, options.dueReason ?? null, projectRoot);
+    state.status = 'in_progress';
+    saveConferCheckpoint(state, projectRoot);
+    const collocated = options.collocatedText?.trim() ||
+        '# Synthesis confer\n\nReview checkpoint context and realign plan.';
+    const agents = [];
+    for (const todo of getSynthesisConsultTodos(plan)) {
+        if (todo.status === 'completed')
+            continue;
+        try {
+            let agentResult;
+            if (options.fixture) {
+                agentResult = writeFixtureConferReceipt(todo.id, todo.subagent, sessionId, projectRoot);
+            }
+            else {
+                const prompt = buildConferPrompt(todo.subagent, todo.task, collocated, options.dueReason ?? null);
+                const outputText = await invokeConferAgent(todo.subagent, prompt, projectRoot);
+                agentResult = applyConferConsultResult(todo.id, todo.subagent, sessionId, outputText, projectRoot);
+            }
+            agents.push(agentResult);
+            if (agentResult.receiptRecorded && agentResult.todoCompleted) {
+                state.completedAgents.push(todo.subagent);
+                saveConferCheckpoint(state, projectRoot);
+            }
+            else {
+                state.status = 'failed';
+                state.lastError = `Receipt or todo completion failed for ${todo.id}`;
+                saveConferCheckpoint(state, projectRoot);
+                return {
+                    status: 'partial',
+                    agents,
+                    message: state.lastError,
+                };
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            state.status = 'failed';
+            state.lastError = message;
+            saveConferCheckpoint(state, projectRoot);
+            agents.push({
+                todoId: todo.id,
+                subagent: todo.subagent,
+                outputText: '',
+                receiptRecorded: false,
+                todoCompleted: false,
+                verdict: null,
+                error: message,
+            });
+            return { status: 'failed', agents, message };
+        }
+    }
+    const refreshed = loadPersistedLeadDevPlan(projectRoot);
+    const done = refreshed &&
+        isSynthesisRealignmentPlan(refreshed) &&
+        areSynthesisConsultTodosComplete(refreshed);
+    state.status = done ? 'completed' : 'failed';
+    if (!done)
+        state.lastError = 'Consult todos remain after confer loop';
+    saveConferCheckpoint(state, projectRoot);
+    return {
+        status: done ? 'completed' : 'partial',
+        agents,
+        message: done
+            ? 'Confer quorum complete — researcher, architect-tools, code-review consulted'
+            : (state.lastError ?? 'Confer incomplete'),
+    };
+}
+const CONFER_AGENT_EMOJI = {
+    researcher: '🔍',
+    'architect-tools': '🏗️',
+    'code-review': '✅',
+    'code-reviewer': '✅',
+    architect: '🏗️',
+    strategist: '🎯',
+};
+function conferAgentEmoji(subagent) {
+    return CONFER_AGENT_EMOJI[subagent] ?? '🤖';
+}
+export function formatConferQuorumReport(result) {
+    if (result.status === 'skipped') {
+        return `ℹ️ Confer skipped: ${result.message}`;
+    }
+    const lines = [
+        `## Confer quorum — ${result.status.toUpperCase()}`,
+        result.message,
+        '',
+    ];
+    for (const agent of result.agents) {
+        const emoji = conferAgentEmoji(agent.subagent);
+        lines.push(`- ${emoji} **${agent.todoId}** (${agent.subagent}): verdict=${agent.verdict ?? 'n/a'} receipt=${agent.receiptRecorded} todo=${agent.todoCompleted}${agent.error ? ` error=${agent.error}` : ''}`);
+    }
+    const plan = loadPersistedLeadDevPlan();
+    const next = plan ? getNextRequiredTodo(plan) : null;
+    if (next) {
+        lines.push('', `**Next todo:** ${next.id} (${next.subagent})`);
+    }
+    return lines.join('\n');
+}

package/dist/nucleus/delegation-gate.d.ts

@@ -1,18 +1,26 @@
 /**
  * Multi-host delegation gate SSOT — pending-delegations + spawn todo enforcement.
  * Grok / Hermes / OpenCode adapters call evaluatePreToolGate via delegation-gate-runtime.
- * Grok-only codex/surface checks remain in pre-tool-use.js after the SSOT gate.
+ * Constitution (11/29/69 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
  */
 import { type PendingDelegation } from './pending-delegations.js';
 export { getActivePendingDelegations } from './pending-delegations.js';
 import { updatePlanTodoStatus, type SpawnToolInput } from './lead-dev-plan-persistence.js';
-export { validateSpawnMatchesTodo, updatePlanTodoStatus, savePersistedLeadDevPlan, } from './lead-dev-plan-persistence.js';
+import { writeSuitSessionBoot, maybeHeatHostStation, type CeremonyLevel, type SpawnPlanMode, type SuitHost, type SuitProfile } from './suit-temperament.js';
+export { writeSuitSessionBoot, maybeHeatHostStation };
+export { extractSpawnCwd, validateAsideWorktreeCwd, provisionGitWorktree } from './aside-worktree.js';
+export { validateSpawnMatchesTodo, updatePlanTodoStatus, savePersistedLeadDevPlan, archiveStaleLeadDevPlan, findRecentStalePlanArchive, } from './lead-dev-plan-persistence.js';
 export { buildReceiptFromConsultOutput, hasValidSynthesisConsultReceipt, isSynthesisConsultTodoId, loadSynthesisConsultReceipt, parseConsultVerdictFromText, tryRecordSynthesisConsultReceipt, writeSynthesisConsultReceipt, type SynthesisConsultReceipt, type SynthesisConsultVerdict, } from './synthesis-consult-receipt.js';
 export declare const updatePlanTodoStatusInPlace: typeof updatePlanTodoStatus;
-export type DelegationGateHost = 'grok' | 'hermes' | 'opencode' | 'openclaw' | 'generic';
+export type DelegationGateHost = SuitHost;
 export interface DelegationGateFeatures {
     lead_dev_mode: boolean;
     auto_chain_delegations: boolean;
+    /** v3 — deny (guided/strict), warn (frontier), off */
+    spawn_plan_mode?: SpawnPlanMode;
+    ceremony?: CeremonyLevel;
+    suit_profile?: SuitProfile;
+    no_new_surface?: boolean;
 }
 export interface ToolGateInput {
     prompt?: string;
@@ -41,6 +49,7 @@ export interface PreToolGateContext {
     sessionId: string | null;
     features: DelegationGateFeatures;
     host?: DelegationGateHost;
+    hookEvent?: string;
 }
 export interface PreToolGateDeny {
     allow: false;
@@ -52,6 +61,9 @@ export interface PreToolGateDeny {
 }
 export interface PreToolGateAllow {
     allow: true;
+    reason?: string;
+    gate?: string;
+    hint?: Record<string, unknown>;
 }
 export type PreToolGateResult = PreToolGateAllow | PreToolGateDeny;
 export interface PostToolSpawnResult {
@@ -65,7 +77,7 @@ export interface PostToolSpawnOptions {
     toolOutput?: unknown;
     sessionId?: string | null;
 }
-export declare function loadDelegationGateFeatures(projectRoot?: string): DelegationGateFeatures;
+export declare function loadDelegationGateFeatures(projectRoot?: string, host?: DelegationGateHost): DelegationGateFeatures;
 export declare function normalizeHostToolInput(toolInput: ToolGateInput): SpawnToolInput & {
     command?: string;
 };
@@ -79,10 +91,8 @@ export declare function evaluateSpawnPlanGate(toolName: string, toolInput: ToolG
 export declare function evaluateSynthesisGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 /** Block writes / unrelated work while pending delegations exist. */
 export declare function evaluatePendingDelegationGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
-/**
- * Full pre-tool evaluation — synthesis gate first, slice recording, then
- * pending gate, then spawn todo gate for subagent tools.
- */
+/** Codex 11 / 29 / 69 + destructive shell — always on, all hosts that call this SSOT. */
+export declare function evaluateConstitutionGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 export declare function evaluatePreToolGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 export declare function evaluatePostToolSpawn(toolName: string, toolInput: ToolGateInput, projectRoot: string, options?: PostToolSpawnOptions): PostToolSpawnResult;
 export declare function isOrchestrateToolEvent(toolName: string, toolInput?: ToolGateInput): boolean;