0xray 4.0.41 → 4.1.0

package/scripts/foundry/release-gate.mjs

@@ -3,10 +3,12 @@
  * release-gate.mjs — Single release checkpoint.
  *
  * Modes:
- *   (default)     build + test + consumer smoke (fresh + upgrade merge)
+ *   (default)     build + test + docs + consumer smoke (fresh + upgrade merge)
  *   --verify-only git + reconcile + release docs + consumer smoke — after push, before publish
  *   --skip-smoke  skip consumer install smoke
- *   --skip-docs   skip release docs validation (not recommended for publish)
+ *   --prove-published  Gate D only: npm lists this version, the annotated tag points at HEAD,
+ *                      and the GitHub Release exists. This command does not publish.
+ *   --skip-docs   refused. Gate C runs on every gate.
  *
  * Usage:
  *   npx @0xray/foundry gate
@@ -21,7 +23,7 @@ import { isXrayExoRepo, millScript, readRootPackage, resolveMillRoot } from "./m
 const rootDir = resolveMillRoot();
 const verifyOnly = process.argv.includes("--verify-only");
 const skipSmoke = process.argv.includes("--skip-smoke");
-const skipDocs = process.argv.includes("--skip-docs");
+const provePublished = process.argv.includes("--prove-published");
 
 function step(label, cmd) {
   console.log(`\n${"─".repeat(60)}\n🔄 ${label}\n${"─".repeat(60)}\n`);
@@ -32,18 +34,114 @@ function docsCheckCmd() {
   return `${JSON.stringify(process.execPath)} ${JSON.stringify(millScript("validate-release-docs.mjs"))}`;
 }
 
+
+/** Gate C is the docs check. A ship gate that skips it is not a pass. */
+export function gateCRefusal(argv = process.argv) {
+  if (argv.includes("--skip-docs")) {
+    return "Gate C cannot be skipped. Remove --skip-docs. The docs check runs on every gate.";
+  }
+  return null;
+}
+
+/**
+ * Gate D facts. listed, tagAnnotated, and tagMatchesHead are booleans.
+ * releaseUrl is the GitHub Release page, or empty when that page is missing.
+ */
+export function provePublishedRelease(proof) {
+  const version = proof.version;
+  const errors = [];
+  if (proof.listed !== true) errors.push(`npm does not list ${version}`);
+  if (proof.tagAnnotated !== true) errors.push(`annotated tag v${version} is missing`);
+  if (proof.tagMatchesHead !== true) errors.push(`annotated tag v${version} does not point at HEAD`);
+  if (typeof proof.releaseUrl !== "string" || proof.releaseUrl.length === 0) {
+    errors.push(`GitHub Release v${version} is missing`);
+  }
+  return errors;
+}
+
+function gitOut(cmd) {
+  return execSync(cmd, { cwd: rootDir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+function originSlug() {
+  const url = gitOut("git remote get-url origin");
+  const match = url.match(/github\.com[:/]([^/]+)\/([^/.]+)(?:\.git)?$/);
+  if (!match) throw new Error(`origin is not a GitHub repo: ${url}`);
+  return { owner: match[1], repo: match[2] };
+}
+
+function collectPublishedProof() {
+  const pkg = readRootPackage(rootDir);
+  const version = pkg.version;
+  const name = pkg.name;
+  let listed = false;
+  try {
+    const view = gitOut(`npm view ${name}@${version} version`);
+    listed = view.split(/\s+/).includes(version);
+  } catch {
+    listed = false;
+  }
+  let tagAnnotated = false;
+  let tagMatchesHead = false;
+  try {
+    tagAnnotated = gitOut(`git cat-file -t v${version}`) === "tag";
+    const tagged = gitOut(`git rev-parse v${version}^{}`);
+    const head = gitOut("git rev-parse HEAD");
+    tagMatchesHead = tagAnnotated && tagged === head;
+  } catch {
+    tagAnnotated = false;
+    tagMatchesHead = false;
+  }
+  let releaseUrl = "";
+  try {
+    const { owner, repo } = originSlug();
+    const body = gitOut(
+      `curl -fsS -H "Accept: application/vnd.github+json" -H "User-Agent: 0xray-release-gate" https://api.github.com/repos/${owner}/${repo}/releases/tags/v${version}`,
+    );
+    const parsed = JSON.parse(body);
+    releaseUrl = typeof parsed.html_url === "string" ? parsed.html_url : "";
+  } catch {
+    releaseUrl = "";
+  }
+  return { version, name, listed, tagAnnotated, tagMatchesHead, releaseUrl };
+}
+
+function runProvePublished() {
+  const proof = collectPublishedProof();
+  const errors = provePublishedRelease(proof);
+  process.stdout.write(`\nGate D — ${proof.name}@${proof.version}\n`);
+  if (errors.length) {
+    for (const error of errors) process.stderr.write(`❌ ${error}\n`);
+    process.stderr.write("\n❌ GATE D FAILED — npm listing, annotated tag at HEAD, and GitHub Release are all required\n\n");
+    process.exit(1);
+  }
+  process.stdout.write(`✅ npm lists ${proof.version}\n`);
+  process.stdout.write(`✅ annotated tag v${proof.version} points at HEAD\n`);
+  process.stdout.write(`✅ GitHub Release ${proof.releaseUrl}\n`);
+  process.stdout.write("\n✅ GATE D PROVEN\n\n");
+}
+
 function runLightGate() {
   const pkg = readRootPackage(rootDir);
   if (verifyOnly) {
-    if (!skipDocs) step("1/1 Release docs (light)", docsCheckCmd());
+    step("1/1 Release docs (light)", docsCheckCmd());
     return;
   }
   if (pkg.scripts.build) step("1/3 Build", "npm run build");
   if (pkg.scripts.test) step("2/3 Tests", "npm test");
-  if (!skipDocs) step("3/3 Release docs (light)", docsCheckCmd());
+  step("3/3 Release docs (light)", docsCheckCmd());
 }
 
 function main() {
+  const refused = gateCRefusal();
+  if (refused) {
+    process.stderr.write(`\n❌ ${refused}\n\n`);
+    process.exit(1);
+  }
+  if (provePublished) {
+    runProvePublished();
+    return;
+  }
   const mode = verifyOnly ? "verify" : "full";
   console.log("\n╔════════════════════════════════════════════════════════╗");
   console.log(`║        🛡️  0xRay Release Gate (${mode})`.padEnd(57) + "║");
@@ -54,9 +152,7 @@ function main() {
       runLightGate();
     } else if (verifyOnly) {
       step("1/6 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
-      if (!skipDocs) {
-        step("2/6 Release docs", docsCheckCmd());
-      }
+      step("2/6 Release docs", docsCheckCmd());
       step(
         "3/6 Plugin infrastructure",
         "node scripts/test/validate-plugins-e2e.cjs --structural-only",
@@ -75,9 +171,7 @@ function main() {
         `${JSON.stringify(process.execPath)} ${JSON.stringify(millScript("assert-packed-dist-cli.mjs"))}`,
       );
       step("3/8 Tests", "npm run test:comprehensive");
-      if (!skipDocs) {
-        step("4/8 Release docs", docsCheckCmd());
-      }
+      step("4/8 Release docs", docsCheckCmd());
       step(
         "5/8 Consumer hook verifiers",
         "npm run verify:pre-commit-diff && npm run verify:pre-push-diff && node scripts/mjs/verify-delegation-gate-core.mjs --host=grok && node scripts/mjs/verify-delegation-gate-core.mjs --host=hermes && node scripts/mjs/verify-delegation-gate-core.mjs --host=opencode && node scripts/mjs/verify-hermes-session-start.mjs && node scripts/mjs/verify-confer-core.mjs && npm run verify:user-aside && npm run build && node scripts/mjs/verify-pipeline-facets.mjs --package-only",
@@ -91,9 +185,11 @@ function main() {
       }
     }
 
-    console.log("\n╔════════════════════════════════════════════════════════╗");
-    console.log("║  ✅ RELEASE GATE PASSED                                ║");
-    console.log("╚════════════════════════════════════════════════════════╝\n");
+    process.stdout.write("\n╔════════════════════════════════════════════════════════╗\n");
+    process.stdout.write("║  ✅ GATE A–C LOCAL PASS                                ║\n");
+    process.stdout.write("║  Gate D is not proven by this command.                 ║\n");
+    process.stdout.write("╚════════════════════════════════════════════════════════╝\n");
+    process.stdout.write("Prove D after publish: npx @0xray/foundry gate --prove-published\n\n");
   } catch {
     console.error("\n❌ RELEASE GATE FAILED — do not tag or publish\n");
     process.exit(1);
@@ -105,4 +201,4 @@ const isMain =
 
 if (isMain) {
   main();
-}
+}

package/scripts/foundry/release.mjs

@@ -191,6 +191,8 @@ async function main() {
       }
     }
     run(`git push origin v${version}`, "push tag");
+    say("Step 8: Gate D");
+    runMill("release-gate.mjs", ["--prove-published"], "gate D");
     return;
   }
 
@@ -281,6 +283,12 @@ async function main() {
     console.log(`  would: git tag -a v${newVersion}`);
   }
   run(`git push origin v${newVersion}`, "push tag");
+  say("Step 8: Gate D");
+  runMill("release-gate.mjs", ["--prove-published"], "gate D");
+  if (dryRun) {
+    say("Dry run did not prove Gate D.");
+    return;
+  }
 
   console.log("\n╔════════════════════════════════════════════════════════╗");
   console.log("║        ✅ Release Complete!                            ║");

package/scripts/mjs/verify-confer-core.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 /**
- * Confer quorum fixture — 3-agent synthesis consult completes via fixture mode.
+ * Confer quorum fixture.
+ * PASS completes. FAIL and no-LLM UNREVIEWED leave the todo open and the checkpoint due.
+ * Temp projects opt into synthesis so a due checkpoint can be observed. The repo default stays off.
  */
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,10 +12,14 @@ import { fileURLToPath } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageRoot = join(__dirname, '../..');
 
+// Fixture PASS is refused unless this process is a test. The live orchestrate-task
+// flag and XRAY_CONFER_FIXTURE stay unreachable when NODE_ENV is not test.
+process.env.NODE_ENV = 'test';
+
 const { buildSynthesisCheckpointPlan } = await import(
   join(packageRoot, 'dist/nucleus/autonomy-kernel.js')
 );
-const { savePersistedLeadDevPlan, areSynthesisConsultTodosComplete } = await import(
+const { savePersistedLeadDevPlan, areSynthesisConsultTodosComplete, loadPersistedLeadDevPlan } = await import(
   join(packageRoot, 'dist/nucleus/lead-dev-plan-persistence.js')
 );
 const { recordExecutionSlice, isSynthesisCheckpointDue } = await import(
@@ -22,46 +28,103 @@ const { recordExecutionSlice, isSynthesisCheckpointDue } = await import(
 const { runConferQuorum, loadConferCheckpoint, CONFER_AGENTS } = await import(
   join(packageRoot, 'dist/nucleus/confer.js')
 );
+const { loadSynthesisConsultReceipt } = await import(
+  join(packageRoot, 'dist/nucleus/synthesis-consult-receipt.js')
+);
+const { readConferReviewHint } = await import(
+  join(packageRoot, 'src/integrations/hooks/confer-hook-runtime.mjs')
+);
+const { buildSessionBootPayload } = await import(
+  join(packageRoot, 'src/integrations/grok/hooks/grok-hook-utils.js')
+);
 
-const sessionId = 'verify-confer-core';
 let failed = 0;
+let checks = 0;
 function pass(n) {
+  checks++;
   console.log(`✅ ${n}`);
 }
 function fail(n, d = '') {
   failed++;
+  checks++;
   console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
 }
 
-const tmp = mkdtempSync(join(tmpdir(), 'xray-confer-verify-'));
-mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
-writeFileSync(
-  join(tmp, '.xray', 'features.json'),
-  JSON.stringify({
-    multi_agent_orchestration: { lead_dev_mode: true, confer_on_synthesis: true },
-    synthesis: { enabled: true, every_n_gates: 1, every_n_turns: 0, every_n_todos_completed: 0 },
-  }),
-);
+function assertRepoSynthesisStaysOff() {
+  const source = readFileSync(join(packageRoot, 'src/nucleus/synthesis.ts'), 'utf8');
+  const defaults = source.match(/function defaultSynthesisConfig\(\)[\s\S]*?return \{([\s\S]*?)\n  \};/);
+  if (defaults && /enabled:\s*false/.test(defaults[1])) pass('repo defaultSynthesisConfig stays enabled: false');
+  else fail('repo defaultSynthesisConfig stays enabled: false');
 
-try {
-  recordExecutionSlice('gate', { projectRoot: tmp, sessionId });
-  if (!isSynthesisCheckpointDue(tmp, sessionId)) fail('step 1: synthesis due');
-  else pass('step 1: synthesis checkpoint due');
+  for (const rel of ['xray/features.json', '.xray/features.json']) {
+    const data = JSON.parse(readFileSync(join(packageRoot, rel), 'utf8'));
+    if (data.synthesis?.enabled === false) pass(`${rel} synthesis.enabled stays false`);
+    else fail(`${rel} synthesis.enabled stays false`, JSON.stringify(data.synthesis));
+  }
+}
 
+function makeProject() {
+  const tmp = mkdtempSync(join(tmpdir(), 'xray-confer-verify-'));
+  mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
+  writeFileSync(
+    join(tmp, '.xray', 'features.json'),
+    JSON.stringify({
+      multi_agent_orchestration: { lead_dev_mode: true, confer_on_synthesis: true },
+      synthesis: { enabled: true, every_n_gates: 1, every_n_turns: 0, every_n_todos_completed: 0 },
+    }),
+  );
+  return tmp;
+}
+
+function seedDuePlan(tmp, sessionId) {
+  recordExecutionSlice('gate', { projectRoot: tmp, sessionId });
+  const due = isSynthesisCheckpointDue(tmp, sessionId);
   const plan = buildSynthesisCheckpointPlan('gate threshold (1/1)', tmp);
-  if (!plan) fail('step 2: synthesis plan');
-  else {
+  if (plan) {
     savePersistedLeadDevPlan(
       { ...plan, persistedAt: new Date().toISOString(), sessionId },
       tmp,
     );
-    pass('step 2: synthesis plan persisted');
   }
+  return { due, plan };
+}
+
+function blocksCheckpoint(label, tmp, sessionId, result, verdict) {
+  const receipt = loadSynthesisConsultReceipt('s.1', tmp);
+  if (result.status === 'partial' && result.agents[0]?.verdict === verdict && result.agents[0]?.todoCompleted === false) {
+    pass(`${label}: quorum stopped on ${verdict}`);
+  } else {
+    fail(`${label}: quorum stopped on ${verdict}`, JSON.stringify(result));
+  }
+  if (receipt?.verdict === verdict) pass(`${label}: receipt verdict ${verdict}`);
+  else fail(`${label}: receipt verdict ${verdict}`, JSON.stringify(receipt));
+  if (!areSynthesisConsultTodosComplete(loadPersistedLeadDevPlan(tmp))) {
+    pass(`${label}: consult todo stays open`);
+  } else {
+    fail(`${label}: consult todo stays open`);
+  }
+  if (isSynthesisCheckpointDue(tmp, sessionId)) pass(`${label}: synthesis checkpoint stays due`);
+  else fail(`${label}: synthesis checkpoint stays due`);
+  const state = loadConferCheckpoint(tmp);
+  if (state?.status === 'failed') pass(`${label}: confer checkpoint not cleared`);
+  else fail(`${label}: confer checkpoint not cleared`, JSON.stringify(state));
+}
+
+assertRepoSynthesisStaysOff();
+
+const passRoot = makeProject();
+const passSession = 'verify-confer-core-pass';
+try {
+  const seeded = seedDuePlan(passRoot, passSession);
+  if (!seeded.due) fail('step 1: synthesis due');
+  else pass('step 1: synthesis checkpoint due');
+  if (!seeded.plan) fail('step 2: synthesis plan');
+  else pass('step 2: synthesis plan persisted');
 
   if (CONFER_AGENTS.length !== 3) fail('step 3: confer agent count', String(CONFER_AGENTS.length));
   else pass('step 3: three confer agents defined');
 
-  const result = await runConferQuorum(tmp, sessionId, {
+  const result = await runConferQuorum(passRoot, passSession, {
     collocatedText: 'verify confer fixture context',
     dueReason: 'gate threshold',
     fixture: true,
@@ -73,31 +136,92 @@ try {
     fail('step 4: confer quorum', JSON.stringify(result));
   }
 
-  const state = loadConferCheckpoint(tmp);
+  const state = loadConferCheckpoint(passRoot);
   if (state?.status === 'completed' && state.completedAgents.length === 3) {
     pass('step 5: confer checkpoint state completed');
   } else {
     fail('step 5: confer state', JSON.stringify(state));
   }
 
-  if (areSynthesisConsultTodosComplete(
-    (await import(join(packageRoot, 'dist/nucleus/lead-dev-plan-persistence.js'))).loadPersistedLeadDevPlan(tmp),
-  )) {
+  if (areSynthesisConsultTodosComplete(loadPersistedLeadDevPlan(passRoot))) {
     pass('step 6: synthesis consult todos complete after confer');
   } else {
     fail('step 6: consult todos incomplete');
   }
 
-  if (!isSynthesisCheckpointDue(tmp, sessionId)) pass('step 7: synthesis checkpoint cleared');
+  if (!isSynthesisCheckpointDue(passRoot, passSession)) pass('step 7: synthesis checkpoint cleared');
   else fail('step 7: checkpoint still due');
 } finally {
-  rmSync(tmp, { recursive: true, force: true });
+  rmSync(passRoot, { recursive: true, force: true });
+}
+
+const failRoot = makeProject();
+const failSession = 'verify-confer-core-fail';
+try {
+  seedDuePlan(failRoot, failSession);
+  const result = await runConferQuorum(failRoot, failSession, {
+    fixture: true,
+    fixtureVerdict: 'FAIL',
+  });
+  blocksCheckpoint('FAIL', failRoot, failSession, result, 'FAIL');
+} finally {
+  rmSync(failRoot, { recursive: true, force: true });
+}
+
+const unreviewedRoot = makeProject();
+const unreviewedSession = 'verify-confer-core-unreviewed';
+try {
+  seedDuePlan(unreviewedRoot, unreviewedSession);
+  const result = await runConferQuorum(unreviewedRoot, unreviewedSession, {
+    fixture: true,
+    fixtureNoLlm: true,
+  });
+  blocksCheckpoint('no-LLM', unreviewedRoot, unreviewedSession, result, 'UNREVIEWED');
+  if (readConferReviewHint(unreviewedRoot) === 'UNREVIEWED') {
+    pass('no-LLM: confer review hint is UNREVIEWED');
+  } else {
+    fail('no-LLM: confer review hint is UNREVIEWED');
+  }
+  const boot = buildSessionBootPayload(unreviewedRoot, 'verify/session-start');
+  if (boot.conferReview === 'UNREVIEWED' && String(boot.conferReviewHint).includes('UNREVIEWED')) {
+    pass('no-LLM: session-boot hint records UNREVIEWED');
+  } else {
+    fail('no-LLM: session-boot hint records UNREVIEWED', JSON.stringify({
+      conferReview: boot.conferReview,
+      conferReviewHint: boot.conferReviewHint,
+    }));
+  }
+} finally {
+  rmSync(unreviewedRoot, { recursive: true, force: true });
+}
+
+const conditionalRoot = makeProject();
+const conditionalSession = 'verify-confer-core-conditional';
+try {
+  seedDuePlan(conditionalRoot, conditionalSession);
+  const result = await runConferQuorum(conditionalRoot, conditionalSession, {
+    fixture: true,
+    fixtureVerdict: 'CONDITIONAL',
+  });
+  const verdicts = result.agents.map((agent) => agent.verdict);
+  if (result.status === 'partial' && verdicts[0] === 'CONDITIONAL' && result.agents[0]?.todoCompleted === false) {
+    pass('CONDITIONAL: explicit conditional does not complete');
+  } else {
+    fail('CONDITIONAL: explicit conditional does not complete', JSON.stringify(result));
+  }
+  if (isSynthesisCheckpointDue(conditionalRoot, conditionalSession)) {
+    pass('CONDITIONAL: checkpoint stays due');
+  } else {
+    fail('CONDITIONAL: checkpoint stays due');
+  }
+} finally {
+  rmSync(conditionalRoot, { recursive: true, force: true });
 }
 
 console.log(
   '\n' +
     (failed === 0
-      ? '🎉 Confer verify passed (7/7).'
+      ? `🎉 Confer verify passed (${checks}/${checks}).`
       : `⚠️  ${failed} confer check(s) failed.`),
 );
-process.exit(failed === 0 ? 0 : 1);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/mjs/verify-pipeline-facets.mjs

@@ -110,7 +110,7 @@ if (packageOnly) {
   }
 
   // P1 — autonomous reporting
-  if (features?.autonomous_reporting?.enabled === true) {
+  if (features?.autonomous_reporting?.enabled === false) {
     pass('autonomous_reporting.enabled');
   } else {
     fail('autonomous_reporting.enabled');

package/scripts/mjs/verify-user-aside-core.mjs

@@ -75,16 +75,15 @@ try {
     35,
     tmp,
   );
-  if (aside?.plan.phases[0]?.todos[0]?.id !== 'suit-nft.a.1.1') {
-    fail('step 3: build aside plan', aside?.plan.phases[0]?.todos[0]?.id);
+  const todo = aside?.plan.phases.flatMap((phase) => phase.todos)[0];
+  if (todo?.id !== 'suit-nft.a.2.1') {
+    fail('step 3: build aside plan', todo?.id);
   } else pass('step 3: namespaced aside todos');
 
   saveUserAside(aside, tmp);
   setActiveAsideId('suit-nft', tmp, 'verify-session');
   if (getActiveAsideId(tmp, 'verify-session') !== 'suit-nft') fail('step 4: active pointer');
   else pass('step 4: active aside pointer with session');
-
-  const todo = aside.plan.phases[0].todos[0];
   const resolved = resolveSpawnPlan({ planTodoId: todo.id }, tmp, 'verify-session');
   if (resolved.source !== 'aside') fail('step 5: resolve spawn plan', JSON.stringify(resolved));
   else pass('step 5: spawn plan resolves to aside');