0xray 4.0.41 → 4.0.42

package/dist/reporting/log-parser.d.ts

@@ -1,4 +1,6 @@
 import { type ParsedLogEntry, type ReportConfig } from "./types.js";
+/** Consumer activity lives in the working directory, not inside the installed package. */
+export declare function activityLogPath(root?: string): string;
 export declare function levelToStatus(level: string): string;
 export declare function inferAgent(component: string): string;
 export declare function parseLogLine(line: string): ParsedLogEntry | null;

package/dist/reporting/log-parser.js

@@ -1,10 +1,13 @@
 import * as fs from "fs";
 import * as path from "path";
 import { createGunzip } from "zlib";
-import { fileURLToPath } from "node:url";
 import { frameworkLogger } from "../core/framework-logger.js";
-const LOG_LINE_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)\s+\[([^\]]+)\]\s+\[([^\]]+)\]\s+(.+?)\s+-\s+(\w+)$/;
-const LOG_LINE_FALLBACK_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)\s+\[([^\]]+)\]\s+(.+?)\s+-\s+(\w+)$/;
+const LOG_LINE_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)\s+\[([^\]]+)\]\s+\[([^\]]+)\]\s+(.+?)\s+-\s+(\w+)(?:\s+\|.*)?$/;
+const LOG_LINE_FALLBACK_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)\s+\[([^\]]+)\]\s+(.+?)\s+-\s+(\w+)(?:\s+\|.*)?$/;
+/** Consumer activity lives in the working directory, not inside the installed package. */
+export function activityLogPath(root = process.cwd()) {
+    return path.join(root, "logs", "framework", "activity.log");
+}
 // Parsed rows stay cached while size and mtime stay the same.
 let currentLogCache = null;
 const rotatedLogCache = new Map();
@@ -160,9 +163,7 @@ function uniqueSorted(logs) {
     return unique;
 }
 export async function readCurrentLogFile(timeRange) {
-    const currentFilePath = fileURLToPath(import.meta.url);
-    const projectRoot = path.resolve(path.dirname(currentFilePath), "../../");
-    const logFile = path.join(projectRoot, "logs", "framework", "activity.log");
+    const logFile = activityLogPath();
     try {
         if (!fs.existsSync(logFile)) {
             currentLogCache = null;

package/dist/skills/orchestrator/SKILL.md

@@ -72,6 +72,18 @@ The hold lasts for the work that named the plane. A sentence that does not say l
 
 Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
 
+## Confer
+
+The TUI that is wearing the suit already spawned the MCP servers. Confer uses those servers. It does not start a private server and it does not run `hermes -z`.
+
+When `.xray/state/confer-ask-s.1.json`, `confer-ask-s.2.json`, and `confer-ask-s.3.json` are on disk:
+
+1. Call the server and tool named in each ask. Researcher and code-review return evidence. Architect returns the assessment with `Verdict: UNREVIEWED`.
+2. Write one verdict line from this TUI's model: `Verdict: PASS`, `Verdict: CONDITIONAL`, or `Verdict: FAIL`, plus top risks and a hardening note.
+3. Call `record_confer_receipt` on `xray-governance` with `todoId`, `subagent`, `sessionId`, and that text.
+
+Only `Verdict: PASS` completes the todo. FAIL, CONDITIONAL, and UNREVIEWED stay open. A session id that does not match the plan does not complete the todo. Grok, OpenCode, Hermes, and OpenClaw use these same three steps. Hermes is a voter only when Hermes is the TUI, and then only as that TUI's own model.
+
 ## Lead cadence (syncopation)
 
 The seven rules are the engine. The cadence is the time signature. Disk SSOT: `grok-bot/OP-PROC.md` (team specifics live in `house/`).

package/docs-site/docs/plates/activity-log.md

@@ -35,4 +35,4 @@ Today those writers append `logs/framework/activity.log`. The features default s
 
 When: on the tool hook, on framework logger flush, and on boot when file logging is on. Why: the report and the pulse read one tail, not a pile of copies.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/boot.md

@@ -66,4 +66,4 @@ sidebar_label: Boot
 └────────────────────────────────────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/centrifuge.md

@@ -27,4 +27,4 @@ JUDGEMENT│   LOOP                   STATE      │PAYMENTS
 
 Loop, domain, state, foundry, and memory ride that turn. Judgement and payments stay off the rotor. Goggles looks on and does not spin. The next turn waits for the next session or compact.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/cursor-compact.md

@@ -32,4 +32,4 @@ Cursor preCompact writes the station card and cannot block the compact.
 
 The file is `src/integrations/cursor/hooks/pre-compact.js`. The message tells the seat to read STATION.md. The plates that belong here are payload-heat and station-heat.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/glossary.md

@@ -23,4 +23,4 @@ What the words mean.
   │ grok-bot · the package you install                         │
   └────────────────────────────────────────────────────────────┘
 ```
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/goggles.md

@@ -19,4 +19,4 @@ It views one plane.
 
 A checkout named `0xray` records `scripts/mjs/run-goggles-mcp.mjs`. Any other project records `node_modules/0xray/scripts/mjs/run-goggles-mcp.mjs`.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/governance.md

@@ -50,4 +50,4 @@ A proposal is deliberated inside the suit, filtered by Dynamo Solar, then merged
 └────────────────────────────────────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/grok-compact.md

@@ -32,4 +32,4 @@ Grok PreCompact runs session-start.js with the pre_compact event.
 
 The hook is `session-start.js --hook-event=pre_compact`. It calls `buildSessionBootPayload`, writes the station card, and prints nothing. It does not match the conversation. Grok ignores hook stdout. The plates that belong here are payload-heat, cursor-compact, and work-fresh.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/grokbot.md

@@ -38,4 +38,4 @@ Give your bots a house: shared rules, one board for the work, and memory that st
   code links: suit → memory, house → doctor, memory → station. Other lines show reading order only.
 ```
 
-stamped · 0xray 4.0.41 · @0xray/grok-bot 0.1.8
+stamped · 0xray 4.0.42 · @0xray/grok-bot 0.1.8

package/docs-site/docs/plates/host-pack.md

@@ -31,4 +31,4 @@ Run it in the tool you already open. Same suit. No new app.
 
 These six already run.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/house.md

@@ -50,4 +50,4 @@ A state flow plate: the stages a house goes through before doctor says House: PA
   └──────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41 · @0xray/grok-bot 0.1.8
+stamped · 0xray 4.0.42 · @0xray/grok-bot 0.1.8

package/docs-site/docs/plates/index.md

@@ -51,4 +51,4 @@ These eight are the pages the file ref names. Each one is a search lens. Each le
 
 These five are the compact path that was opened. Each one is a search lens. Each lens lists one skill and the plates that belong with it.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/inference-files.md

@@ -32,4 +32,4 @@ Inference cycle state already lives under .xray/inference.
 
 Cycle state, history, graded ids, and governance state are already there. Session files still fall back to `docs/inference` until the writers move.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/kept-line.md

@@ -32,4 +32,4 @@ A station rewrite keeps one Fresh line and drops the copies.
 
 mergeStationMarkdown in src/integrations/hooks/station-hook-runtime.cjs treats a Fresh line as stock. Copies are not preserved. When the new card has no Fresh line, the latest one is kept. The plates that belong here are station-card and work-fresh.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/kits.md

@@ -27,4 +27,4 @@ Add a power. Memory, judgment, or payments.
 
 Three. That's the set.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/lens-gate.md

@@ -32,4 +32,4 @@ A search names one plane or it stops.
 
 lensBeforeResearch in src/integrations/hooks/goggles-pipeline.mjs returns null when the call is not research, and when the spoken text names exactly one card plane. Zero names, or more than one, deny with Name one plane. A shell that reads a project source file is research. The first open of a source file that no lens lists is allowed and remembered. The next search stops until that file is on a lens and the plate is on disk. The hook does not author the plate. The plate that belongs here is pre-tool.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/lens-page.md

@@ -32,4 +32,4 @@ The lens page is the card for one plane.
 
 `formatCardPane` in `src/integrations/hooks/goggles-pipeline.mjs` draws the card. Read the card instead of searching the tree. The plates that belong here are record-map and lens-gate.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/live-mesh.md

@@ -38,4 +38,4 @@ Ping-pong eng events become one ordered JSON feed, then a mesh render. Markdown
 
 Paths live under `house/live-mesh/`. Schema is `schema.json`. The plate that belongs here is house.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/memory-recall.md

@@ -41,4 +41,4 @@ Intent names one plate. Equal top scores recall nothing. A missing worn copy is
 
 A look returns the named plane, the matched law names, and the current lines from the session-note index. It does not write a law.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/notes-page.md

@@ -33,4 +33,4 @@ Notes are the body the station card cannot hold.
 The page is `.xray/state/NOTES.md`. The pickup line equals the station intent. The default depth is the working notes: the point, the coverage, the library, the open pull requests, the rituals, and the next cut. A pickup line alone does not survive a compact. PreCompact calls `stampNotesPickup`, which updates only that line and leaves the body alone. The hook does not check the body. The seat writes it before the compact. Do not commit this file. Do not feed it to Repertoire.
 
 The station module writes this page. Heat keeps the current lines in `.xray/state/repertoire/session-notes.json` beside the laws. The wake cascade reads that index and does not write a law. A replaced note stays in that index as history. The short index returns the current line.
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/orchestration.md

@@ -58,4 +58,4 @@ Each tool is its own call. `spawnAside` opens around `orchestrate-task`, `analyz
 └────────────────────────────────────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/package-face.md

@@ -32,4 +32,4 @@ A release writes the package face, and the agent reads it.
 
 The face is `README.md`, `package.json`, `AGENTS.md`, `llms.txt`, `CHANGELOG.md`, and `SKILLS.md`. Do not hand-bump the version.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/payload-heat.md

@@ -32,4 +32,4 @@ buildSessionBootPayload calls applyStationHeat and writes the station card.
 
 The function is in `src/integrations/grok/hooks/grok-hook-utils.js`. The plates that belong here are station-heat and pickup-stamp.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/pickup-stamp.md

@@ -32,4 +32,4 @@ stampNotesPickup writes one pickup line and leaves the rest of NOTES.md alone.
 
 The comment on the function is one pickup line. There is no check that the working notes are present. The plate that belongs here is notes-page.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/pre-tool.md

@@ -32,4 +32,4 @@ The tool hook is where the lens gate runs.
 
 pre-tool-use.js joins the command, the written content, and the paths, then calls lensBeforeResearch. A deny ends the hook. The plate that belongs here is lens-gate.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/processor.md

@@ -43,4 +43,4 @@ sidebar_label: Processor
 └──────────────────────────────────────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/record-map.md

@@ -39,4 +39,4 @@ Trail: state and logs under `.xray`. Codex is already loaded. This plate is the
 The published manual is `docs-site/docs/`. The rule sheet is `grok-bot/OP-PROC.md`. Neither is one of the five pages.
 
 Goggles plane `record-map` is the lens over this map. Station and the notes page belong to the station module. Repertoire laws stay in the law file. The session-note index sits beside that file.
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/reflection-page.md

@@ -32,4 +32,4 @@ A reflection is one episode written under docs/reflections.
 
 The loader is `loadReflectionInferences` in `src/inference/inference-accumulator.ts`. A reflection is not a repertoire law.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/reporting.md

@@ -36,4 +36,4 @@ Logs become a report. A valid cache returns the formatted report and does not wr
 └────────────────────────────────────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/review.md

@@ -54,4 +54,4 @@ A state flow plate: one critic pass, one fix, one re-review, then stop.
 
 A FAIL names the file and a test that fails on the old code. One author fixes that hole. A second session waits while the verdict is open. Re-review that new head. A hole the new test did not lock returns to ONE FIX. A PASS ends the plate. A note stays a note and does not open another lap.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/routing.md

@@ -59,4 +59,4 @@ Task text becomes an agent. `scoreAndRoute` scores the work, then `routeToAgent`
 └──────────────────────────────────────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/session-capture.md

@@ -35,4 +35,4 @@ Today that file is `docs/inference/latest-session.json`. The home is `.xray/infe
 
 Station reads the file for heat. The inference accumulator reads `session-*.json` beside it. Do not mint a `session-<date>-<sha>` file for the station note.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/site-manual.md

@@ -32,4 +32,4 @@ The published manual is docs-site/docs.
 
 Guides, architecture, and introduction live here. Factory notes under `docs/` are a different set. Reflections stay in `docs/reflections/`.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/stamp-plate.md

@@ -32,4 +32,4 @@ A stamped plate is one drawing for one plane.
 
 The file is `docs-site/docs/plates/<id>.md`. Each opened segue gets its own plate. The hook does not author this file. The plate that belongs here is review.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/station-card.md

@@ -35,4 +35,4 @@ Read it after a compact. Leave Intent alone. The plan is the next cut. The long
 The station module writes this card. Heat adds `Cascade: record-map · notes N current`. The count is the current index. The body stays on the notes page.
 
 The card keeps the named plane. `Sleeve: on` means the previous ticket came back, the worn plate matched the package, the previous ticket matched the working record, and inspect passed. Judgement is continue, retry N, stop, or start. The same miss keeps its retry. A different ticket stops. Payments is on only when the ticket is a payment.
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/station-heat.md

@@ -32,4 +32,4 @@ On a compact event applyStationHeat stamps the notes pickup line.
 
 `isCompactHook` is true when the hook name contains compact. The body of NOTES.md is left alone. The plates that belong here are pickup-stamp and notes-page.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/suit-organs.md

@@ -35,4 +35,4 @@ Reporting reads the activity log and may write a report. Station reads `latest-s
 
 Repertoire already keeps `inference-state.json` and the day log under `.xray/state/repertoire/`. Goggles does not write these files. It reads a plate when one plane is named.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/suit-settings.md

@@ -32,4 +32,4 @@ Suit settings are features, config, and codex.
 
 There is no settings.json. The files are `.xray/features.json`, `.xray/config.json`, and `.xray/codex.json`. The package copies live under `xray/`.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/suit-wear.md

@@ -36,4 +36,4 @@ A worn project is a consumer. Its writes go to its own `.xray/logs` and `.xray/i
 
 A fresh wear fastens mill and inspect. Grok's Goggles launcher stays on that install: the checkout script when the package name is `0xray`, and `node_modules/0xray` for every other project.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/suit.md

@@ -39,4 +39,4 @@ Give your agent a suit. The rules stay on, you add powers, and it runs in the to
 
 Same rules in the repo. You are not locked into one app.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/trail-state.md

@@ -32,4 +32,4 @@ The suit writes its trail under .xray.
 
 Session boot, the lens match line, and the station card are state. The agent reads them. Do not commit `.xray/state`.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/work-fresh.md

@@ -32,4 +32,4 @@ Refresh writes one Fresh line from git and the published package.
 
 refreshFreshness in src/nucleus/work-freshness.mjs fetches origin, reads npm view 0xray version, and returns that one line. A compact hook does not call it. The plate that belongs here is station-card.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/docs-site/docs/plates/write-home.md

@@ -35,4 +35,4 @@ The path table is `src/integrations/hooks/write-home.cjs`. Writers use it. Reade
 
 Still on the old path until each caller is rewired: the activity logger, the framework logger, the pipeline hook, the Grok hook, the Hermes bridge, station capture, `saveSessionInference`, reporting, pulse, monitor, and `features.json` `log_path`.
 
-stamped · 0xray 4.0.41
+stamped · 0xray 4.0.42

package/llms.txt

@@ -4,6 +4,8 @@
 
 **4.0** — mill+inspect plant, 7 MCPs, Codex 69. Constitution always on.
 
+Confer votes. Burst runs the swarm.
+
 Default consumer wear is **mill plant** (`mill` + `inspect`), not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump. Do not use costume to land hangar shops. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares. Organs (looker, vibe, mixer) live in the mill — adding an organ is a mill publish, not an xray catalog PR. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Inspect reports the last bed or blip receipt the mill exported. Nested mill `@0xray/foundry` 0.1.12. Not costume.
 
 ## Wear (what a stranger gets)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.41",
+  "version": "4.0.42",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "test": "vitest run",
     "test:batch": "npm test",
     "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",
-    "test:core-framework": "npm test -- src/__tests__/unit/v2-deletion-protection.test.ts",
+    "test:core-framework": "npm test -- src/__tests__/unit/v2-deletion-protection.test.ts src/__tests__/unit/confer.test.ts src/__tests__/unit/local-confer.test.ts src/__tests__/unit/synthesis-consult-receipt.test.ts src/__tests__/unit/governance-nollm-merge.test.ts",
     "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",
     "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",
     "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",