0xray 4.0.40 → 4.0.42

package/src/mcps/governance.server.ts

@@ -29,6 +29,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { fileURLToPath } from "url";
 import { randomUUID } from "crypto";
+import { applyConferConsultResult } from "../nucleus/confer.js";
 import { getGovernanceService } from "../governance/governance-service.js";
 import { getCodexPolicyService } from "../governance/codex-policy.service.js";
 import { initializeGovernanceIntegration, shutdownGovernanceIntegration } from "../integrations/governance/index.js";
@@ -136,6 +137,24 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
           required: [],
         },
       },
+      {
+        name: "record_confer_receipt",
+        description:
+          "Record a confer verdict written by the wearing TUI. " +
+          "The TUI already called the seat's MCP server. This tool stores the receipt. " +
+          "Only Verdict: PASS completes the consult todo.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            todoId: { type: "string", description: "Consult todo id, such as s.1" },
+            subagent: { type: "string", description: "researcher, architect-tools, or code-review" },
+            sessionId: { type: "string", description: "Plan session id" },
+            outputText: { type: "string", description: "Host verdict text, including a Verdict line" },
+            projectRoot: { type: "string", description: "Checkout root. Defaults to XRAY_ROOT or the process cwd." },
+          },
+          required: ["todoId", "subagent", "sessionId", "outputText"],
+        },
+      },
       {
         name: "get_active_codex",
         description:
@@ -159,6 +178,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
       "govern_proposals": async (args) => this.handleGovernProposals(this.validateGovernProposalsArgs(args)),
       "govern_reflection": async (args) => this.handleGovernReflection(this.validateGovernReflectionArgs(args)),
       "get_active_codex": async (args) => this.handleGetActiveCodex(args as { includeRaw?: boolean }),
+      "record_confer_receipt": async (args) => this.handleRecordConferReceipt(args),
     };
     this.setupToolHandlers();
   }
@@ -210,6 +230,8 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
             return await this.handleGovernReflection(this.validateGovernReflectionArgs(args));
           case "get_active_codex":
             return await this.handleGetActiveCodex(args as { includeRaw?: boolean });
+          case "record_confer_receipt":
+            return await this.handleRecordConferReceipt(args);
           default:
             throw new Error(`Unknown tool: ${name}`);
         }
@@ -334,6 +356,33 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
     });
   }
 
+  private async handleRecordConferReceipt(args: unknown): Promise<CallToolResult> {
+    if (!args || typeof args !== "object") {
+      throw new Error("record_confer_receipt requires an object argument");
+    }
+    const obj = args as Record<string, unknown>;
+    const todoId = typeof obj.todoId === "string" ? obj.todoId.trim() : "";
+    const subagent = typeof obj.subagent === "string" ? obj.subagent.trim() : "";
+    const sessionId = typeof obj.sessionId === "string" ? obj.sessionId.trim() : "";
+    const outputText = typeof obj.outputText === "string" ? obj.outputText : "";
+    if (!todoId || !subagent || !sessionId || !outputText.trim()) {
+      throw new Error("record_confer_receipt requires todoId, subagent, sessionId, and outputText");
+    }
+    const projectRoot =
+      typeof obj.projectRoot === "string" && obj.projectRoot.trim()
+        ? obj.projectRoot
+        : process.env.XRAY_ROOT || process.cwd();
+    const result = applyConferConsultResult(todoId, subagent, sessionId, outputText, projectRoot);
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(result),
+        },
+      ],
+    };
+  }
+
   private async handleGetActiveCodex(args: { includeRaw?: boolean }): Promise<CallToolResult> {
     const includeRaw = args?.includeRaw === true;
     const snapshot = await getCodexPolicyService().getCurrentCodex(includeRaw);

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -14,6 +14,7 @@ import {
   tryLLMGovernance,
 } from "../../governance/llm-governance-provider.js";
 import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
+import { buildHostConferEvidence } from "../../nucleus/confer-host.js";
 
 interface CodeReviewResult {
   file: string;
@@ -439,6 +440,13 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
+    if (proposalType === "synthesis-confer") {
+      const packet = [proposalTitle, proposalDescription, ...(evidence || [])].filter(Boolean).join("\n\n");
+      return {
+        content: [{ type: "text", text: buildHostConferEvidence("code-review", packet) }],
+      };
+    }
+
     const vote =
       (await tryLLMGovernance(
         "code-review",

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -8,10 +8,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import {
-  isGovernanceLlmConfigured,
-  tryLLMGovernance,
-} from "../../governance/llm-governance-provider.js";
+import { attemptLLMGovernance } from "../../governance/llm-governance-provider.js";
 import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface SecurityVulnerability {
@@ -999,17 +996,19 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
+    const attempt = await attemptLLMGovernance(
+      "security-audit",
+      proposalTitle,
+      proposalDescription,
+      evidence,
+      proposalType,
+    );
     const vote =
-      (await tryLLMGovernance(
-        "security-audit",
-        proposalTitle,
-        proposalDescription,
-        evidence,
-        proposalType,
-      )) ??
+      attempt.vote ??
       localConferVote({
         role: "security-audit",
-        llmConfigured: isGovernanceLlmConfigured(),
+        llmConfigured: attempt.miss !== "not-configured",
+        ...(attempt.miss ? { miss: attempt.miss } : {}),
       });
 
     return {

package/src/mcps/mcp-client.ts

@@ -400,7 +400,7 @@ export class MCPClient extends EventEmitter {
     this.emit('tool.before', beforeEvent);
 
     const serverName = this.config.serverName;
-    const isGovernanceServer = ['code-review', 'security-audit', 'researcher', 'governance'].includes(serverName);
+    const isGovernanceServer = ['code-review', 'security-audit', 'researcher', 'architect', 'governance'].includes(serverName);
     const isGovernanceTool = toolName === 'analyze_proposal';
     const preferReal = this.isPureMcpMode || isGovernanceServer || isGovernanceTool;
 

package/src/mcps/orchestrator/handlers/complexity-handler.ts

@@ -12,6 +12,7 @@ import {
   persistLeadDevPlan,
 } from '../../../nucleus/autonomy-kernel.js';
 import {
+  conferFixtureAllowed,
   formatConferQuorumReport,
   isConferEnabled,
   runConferQuorum,
@@ -286,7 +287,7 @@ export class ComplexityHandler {
           collocatedText?: string;
         } = {
           dueReason: args.synthesisDueReason ?? null,
-          fixture: args.conferFixture === true,
+          fixture: conferFixtureAllowed() && args.conferFixture === true,
         };
         if (args.collocatedText) conferOpts.collocatedText = args.collocatedText;
         const conferResult = await runConferQuorum(process.cwd(), args.sessionId, conferOpts);

package/src/mcps/researcher.server.ts

@@ -13,8 +13,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
 import {
-  isGovernanceLlmConfigured,
-  tryLLMGovernance,
+  attemptLLMGovernance,
 } from "../governance/llm-governance-provider.js";
 import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
@@ -23,6 +22,7 @@ import {
   formatMemoryRoutingBlock,
   resolveResearcherMemoryContext,
 } from "./researcher-confidence.js";
+import { buildHostConferEvidence } from "../nucleus/confer-host.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
 
 interface SearchResult {
@@ -465,6 +465,13 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs): Promise<CallToolResult> {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args || {};
 
+    if (proposalType === "synthesis-confer") {
+      const packet = [proposalTitle, proposalDescription, ...(evidence || [])].filter(Boolean).join("\n\n");
+      return {
+        content: [{ type: "text", text: buildHostConferEvidence("researcher", packet) }],
+      };
+    }
+
     const memoryContext = await resolveResearcherMemoryContext({
       proposalTitle,
       proposalDescription,
@@ -476,19 +483,21 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
       enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
     }
 
+    const attempt = await attemptLLMGovernance(
+      "researcher",
+      proposalTitle || "",
+      proposalDescription || "",
+      enrichedEvidence,
+      proposalType || "",
+    );
     const vote =
-      (await tryLLMGovernance(
-        "researcher",
-        proposalTitle || "",
-        proposalDescription || "",
-        enrichedEvidence,
-        proposalType || "",
-      )) ??
+      attempt.vote ??
       localConferVote({
         role: "researcher",
-        llmConfigured: isGovernanceLlmConfigured(),
+        llmConfigured: attempt.miss !== "not-configured",
         highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
         recommendedAgent: memoryContext?.recommendedAgent,
+        ...(attempt.miss ? { miss: attempt.miss } : {}),
       });
 
     const memoryRoutingBlock = memoryContext

package/src/skills/orchestrator/SKILL.md

@@ -72,6 +72,18 @@ The hold lasts for the work that named the plane. A sentence that does not say l
 
 Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
 
+## Confer
+
+The TUI that is wearing the suit already spawned the MCP servers. Confer uses those servers. It does not start a private server and it does not run `hermes -z`.
+
+When `.xray/state/confer-ask-s.1.json`, `confer-ask-s.2.json`, and `confer-ask-s.3.json` are on disk:
+
+1. Call the server and tool named in each ask. Researcher and code-review return evidence. Architect returns the assessment with `Verdict: UNREVIEWED`.
+2. Write one verdict line from this TUI's model: `Verdict: PASS`, `Verdict: CONDITIONAL`, or `Verdict: FAIL`, plus top risks and a hardening note.
+3. Call `record_confer_receipt` on `xray-governance` with `todoId`, `subagent`, `sessionId`, and that text.
+
+Only `Verdict: PASS` completes the todo. FAIL, CONDITIONAL, and UNREVIEWED stay open. A session id that does not match the plan does not complete the todo. Grok, OpenCode, Hermes, and OpenClaw use these same three steps. Hermes is a voter only when Hermes is the TUI, and then only as that TUI's own model.
+
 ## Lead cadence (syncopation)
 
 The seven rules are the engine. The cadence is the time signature. Disk SSOT: `grok-bot/OP-PROC.md` (team specifics live in `house/`).

package/vendor/@0xray/repertoire/scripts/run-live-synthesis-checkpoint.mjs

@@ -5,7 +5,8 @@
  * Usage:
  *   node scripts/run-live-synthesis-checkpoint.mjs seed [--session-id=ID]
  *   node scripts/run-live-synthesis-checkpoint.mjs status
- *   node scripts/run-live-synthesis-checkpoint.mjs complete-todo --id=s.1
+ *   node scripts/run-live-synthesis-checkpoint.mjs complete-todo
+ *     (refuses: a CLI flag must not mint PASS or clear consult todos)
  *   node scripts/run-live-synthesis-checkpoint.mjs finish
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -132,56 +133,9 @@ async function cmdStatus() {
 }
 
 async function cmdCompleteTodo() {
-  const todoId = process.argv.find((a) => a.startsWith('--id='))?.split('=')[1];
-  const verdict = process.argv.find((a) => a.startsWith('--verdict='))?.split('=')[1];
-  if (!todoId) {
-    err('Usage: complete-todo --id=s.1 --verdict=PASS|CONDITIONAL|FAIL');
-    process.exit(1);
-  }
-  if (!verdict || !['PASS', 'CONDITIONAL', 'FAIL'].includes(verdict)) {
-    err('❌ --verdict=PASS|CONDITIONAL|FAIL required (consult receipt gate)');
-    process.exit(1);
-  }
-
-  const sessionId = parseSessionId();
-  const { persistence } = await loadXray();
-  const { writeSynthesisConsultReceipt } = await import(
-    join(xrayRoot, 'dist/nucleus/synthesis-consult-receipt.js'),
-  );
-
-  const plan = persistence.loadPersistedLeadDevPlan(root);
-  const consultTodo = plan
-    ? persistence.getSynthesisConsultTodos(plan).find((t) => t.id === todoId)
-    : null;
-  if (!consultTodo) {
-    err(`❌ Consult todo ${todoId} not found in lead-dev plan`);
-    process.exit(1);
-  }
-
-  writeSynthesisConsultReceipt(
-    todoId,
-    {
-      sessionId: plan?.sessionId ?? sessionId,
-      subagent: consultTodo.subagent,
-      verdict,
-      topRisks: [],
-      hardeningNote: process.argv.find((a) => a.startsWith('--note='))?.split('=')[1] ?? '',
-    },
-    root,
-  );
-
-  const updated = persistence.updatePlanTodoStatus(todoId, 'completed', root);
-  if (!updated) {
-    err(`❌ Receipt gate blocked completion for ${todoId}`);
-    process.exit(1);
-  }
-
-  const refreshed = persistence.loadPersistedLeadDevPlan(root);
-  const todos = refreshed ? persistence.getSynthesisConsultTodos(refreshed) : [];
-  const allDone = todos.length > 0 && todos.every((t) => t.status === 'completed');
-  log(`✅ Marked ${todoId} completed (receipt: ${verdict})`);
-  log(`📊 consult todos: ${todos.map((t) => `${t.id}:${t.status}`).join(', ')}`);
-  if (allDone) log('🎉 All consult todos complete — checkpoint should clear on next gate eval');
+  err('❌ complete-todo cannot mint a PASS receipt or clear consult todos.');
+  err('A consult todo completes only when Confer records a real model approve.');
+  process.exit(1);
 }
 
 async function cmdFinish() {

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.40",
+  "version": "4.0.42",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/xray/features.schema.json

@@ -45,7 +45,7 @@
         },
         "confer_on_synthesis": {
           "type": "boolean",
-          "description": "Auto-run 3-agent confer quorum at synthesis checkpoint (default true)"
+          "description": "Opt in to the 3-agent confer quorum. A missing key stays off."
         },
         "confer": {
           "type": "object",