0xray 4.0.6 → 4.0.8

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.8",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/CHANGELOG.md

@@ -30,6 +30,25 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Mill plant fastens **inspect** (inspect AI work) plus `mill`. Not empty. Mill 0.1.6.
 - Nested mill **0.1.7**: inspect organ, four floors, passwd HOME, mill CI receipt. 4.0.5.
 - Nested mill **0.1.8**: isolated Hermes/OpenClaw, consumer tarball GET, CLI mint inspects. 4.0.6.
+- Nested mill **0.1.9**: inventory DNA for Groover 0xray-suit pack. 4.0.7.
+
+---
+
+## [4.0.8] - 2026-09-11
+
+### 🔄 Changes
+
+### 🔎 Other Changes
+- fix(foundry): mill release gate uses test:comprehensive like mill CI (bd980ea3f)
+- fix(confer): allow undefined on optional local vote fields (e4436af8f)
+- fix(confer): abstain locally; do not rubber-stamp analyze_proposal (0f6c61cbe)
+- fix(confer): local vote when nested LLM is not configured (eb6004b07)
+
+---
+
+## [4.0.7] - 2026-09-09
+
+Nested mill **0.1.9**. Inventory writes `dna` (keccak256 of canonical JSON without `mintedAt`). Inspect echoes dna + pack `0xray-suit`. Mill does not mint on chain. Not 5.0.0.
 
 ---
 

package/dist/governance/llm-governance-provider.d.ts

@@ -5,6 +5,7 @@ export interface GovernanceVote {
     reasoning: string;
 }
 export declare function resolveHermesBin(): string;
+export declare function isGovernanceLlmConfigured(): boolean;
 export declare function hermesCliAvailable(): boolean;
 export declare function tryLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceVote | null>;
 export declare function checkHermesOAuthStatus(): {

package/dist/governance/llm-governance-provider.js

@@ -94,6 +94,9 @@ function getConfig() {
     }
     return null;
 }
+export function isGovernanceLlmConfigured() {
+    return getConfig() !== null;
+}
 export function hermesCliAvailable() {
     try {
         execFileSync(resolveHermesBin(), ["--version"], {

package/dist/governance/local-confer.d.ts

@@ -0,0 +1,10 @@
+import type { GovernanceRole, GovernanceVote } from "./llm-governance-provider.js";
+export type LocalConferInput = {
+    role: GovernanceRole;
+    highConfidenceTrapPresent?: boolean | undefined;
+    recommendedAgent?: string | null | undefined;
+    llmConfigured?: boolean | undefined;
+};
+/** Receipt when nested LLM is absent or returned no vote. Never approve — analyze_proposal feeds mergeVotes. */
+export declare function localConferVote(input: LocalConferInput): GovernanceVote;
+export declare function formatGovernanceVoteText(vote: GovernanceVote, extra?: string): string;

package/dist/governance/local-confer.js

@@ -0,0 +1,27 @@
+/** Receipt when nested LLM is absent or returned no vote. Never approve — analyze_proposal feeds mergeVotes. */
+export function localConferVote(input) {
+    const role = input.role;
+    if (input.llmConfigured) {
+        return {
+            decision: "abstain",
+            confidence: 0.5,
+            reasoning: `Local confer (${role}); nested LLM configured but returned no vote.`,
+        };
+    }
+    if (input.highConfidenceTrapPresent) {
+        const agent = input.recommendedAgent?.trim() || "architect";
+        return {
+            decision: "abstain",
+            confidence: 0.62,
+            reasoning: `Local confer (${role}); nested LLM not configured. Repertoire high-confidence ontological trap — route to ${agent} before implementation.`,
+        };
+    }
+    return {
+        decision: "abstain",
+        confidence: 0.58,
+        reasoning: `Local confer (${role}); nested LLM not configured.`,
+    };
+}
+export function formatGovernanceVoteText(vote, extra = "") {
+    return `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${extra}`;
+}

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -7,7 +7,8 @@
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
     constructor() {
         super("code-review", "3.1.0");
@@ -315,22 +316,16 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const vote = await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType);
-        if (!vote) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-                    },
-                ],
-            };
-        }
+        const vote = (await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType)) ??
+            localConferVote({
+                role: "code-review",
+                llmConfigured: isGovernanceLlmConfigured(),
+            });
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+                    text: formatGovernanceVoteText(vote),
                 },
             ],
         };

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -7,7 +7,8 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
     constructor() {
         super("security-audit", "3.1.0");
@@ -660,22 +661,16 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const vote = await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType);
-        if (!vote) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-                    },
-                ],
-            };
-        }
+        const vote = (await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType)) ??
+            localConferVote({
+                role: "security-audit",
+                llmConfigured: isGovernanceLlmConfigured(),
+            });
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+                    text: formatGovernanceVoteText(vote),
                 },
             ],
         };

package/dist/mcps/researcher.server.js

@@ -10,7 +10,8 @@
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
-import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
 import { buildMemoryRoutingEvidence, formatMemoryRoutingBlock, resolveResearcherMemoryContext, } from "./researcher-confidence.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
@@ -390,28 +391,21 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
         if (memoryContext?.confidence.highConfidenceTrapPresent) {
             enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
         }
-        const vote = await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", enrichedEvidence, proposalType || "");
+        const vote = (await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", enrichedEvidence, proposalType || "")) ??
+            localConferVote({
+                role: "researcher",
+                llmConfigured: isGovernanceLlmConfigured(),
+                highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
+                recommendedAgent: memoryContext?.recommendedAgent,
+            });
         const memoryRoutingBlock = memoryContext?.confidence.highConfidenceTrapPresent
             ? `\n${formatMemoryRoutingBlock(memoryContext)}`
             : "";
-        if (!vote) {
-            const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
-                ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-                : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: ${abstainReason}${memoryRoutingBlock}`,
-                    },
-                ],
-            };
-        }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${memoryRoutingBlock}`,
+                    text: formatGovernanceVoteText(vote, memoryRoutingBlock),
                 },
             ],
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.6",
+  "version": "4.0.8",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [0.1.9] - 2026-09-09
+
+Inventory writes `dna` (keccak256 of canonical JSON without `mintedAt`). Inspect receipt echoes `dna` + pack `0xray-suit` for Groover GRVR. Mill does not mint on chain. Not an 8th MCP. Not 5.0.
+
 ## [0.1.8] - 2026-09-09
 
 Isolated HOME skips machine `~/.hermes` and `~/.openclaw` (passwd home, same gate as Grok). Inspect GETs a public consumer tarball (`@0xray/review-suit`). CLI `mint` runs inspect after overlay; postinstall does not. Not an 8th MCP. Not 5.0.

package/scripts/foundry/inspect.mjs

@@ -119,6 +119,8 @@ function checkReceipt(root) {
     suit: inventory.suit,
     mill: inventory.mill,
     millPlant: millPlantSkills,
+    dna: typeof inventory.dna === "string" ? inventory.dna : null,
+    pack: "0xray-suit",
     detail: ok ? null : "millPlant.skills must include mill and inspect",
   };
 }
@@ -273,10 +275,13 @@ export async function inspectSuit(root, opts = {}) {
   checks.push(checkIsolatedHome(env, machineHome));
 
   const failed = checks.filter((c) => c.ok === false);
+  const receipt = checks.find((c) => c.id === "receipt") || {};
   return {
     ok: failed.length === 0,
     failed: failed.map((c) => c.id),
     checks,
+    dna: receipt.dna || null,
+    pack: "0xray-suit",
   };
 }
 

package/scripts/foundry/mill-dna.cjs

@@ -0,0 +1,50 @@
+/**
+ * Canonical mill DNA for Groover GRVR. keccak256 of inventory without mintedAt/dna.
+ * Not a chain client. Not an 8th MCP.
+ */
+"use strict";
+
+const { keccak_256 } = require("./mill-keccak.cjs");
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+
+function dnaPayload(inventory) {
+  if (!isPlainObject(inventory)) {
+    throw new Error("inventory object required for mill DNA");
+  }
+  const payload = { ...inventory };
+  delete payload.mintedAt;
+  delete payload.dna;
+  return payload;
+}
+
+function inventoryDna(inventory) {
+  const json = canonicalJson(dnaPayload(inventory));
+  const digest = keccak_256(Buffer.from(json, "utf8"));
+  return `0x${Buffer.from(digest).toString("hex")}`;
+}
+
+function attachInventoryDna(inventory) {
+  if (!isPlainObject(inventory)) return inventory;
+  const next = { ...inventory };
+  next.dna = inventoryDna(next);
+  return next;
+}
+
+module.exports = {
+  canonicalJson,
+  dnaPayload,
+  inventoryDna,
+  attachInventoryDna,
+};

package/scripts/foundry/mill-keccak.cjs

@@ -0,0 +1,306 @@
+/* vendored @noble/hashes keccak_256 — mill DNA. Not an 8th MCP. */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// <stdin>
+var stdin_exports = {};
+__export(stdin_exports, {
+  keccak_256: () => keccak_256
+});
+module.exports = __toCommonJS(stdin_exports);
+
+// node_modules/@noble/hashes/esm/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
+var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
+var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
+var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
+
+// node_modules/@noble/hashes/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function anumber(n) {
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new Error("positive integer expected, got " + n);
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function toBytes(data) {
+  if (typeof data === "string")
+    data = utf8ToBytes(data);
+  abytes(data);
+  return data;
+}
+var Hash = class {
+};
+function createHasher(hashCons) {
+  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+  const tmp = hashCons();
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = () => hashCons();
+  return hashC;
+}
+
+// node_modules/@noble/hashes/esm/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+    if (R & _2n)
+      t ^= _1n << (_1n << /* @__PURE__ */ BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
+var rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+function keccakP(s, rounds = 24) {
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++)
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      for (let x = 0; x < 10; x++)
+        B[x] = s[y + x];
+      for (let x = 0; x < 10; x++)
+        s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak extends Hash {
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    super();
+    this.pos = 0;
+    this.posOut = 0;
+    this.finished = false;
+    this.destroyed = false;
+    this.enableXOF = false;
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen);
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest() {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var gen = (suffix, blockLen, outputLen) => createHasher(() => new Keccak(blockLen, suffix, outputLen));
+var keccak_256 = /* @__PURE__ */ (() => gen(1, 136, 256 / 8))();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  keccak_256
+});
+/*! Bundled license information:
+
+@noble/hashes/esm/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/

package/scripts/foundry/mint-suit.cjs

@@ -10,6 +10,8 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
+const { attachInventoryDna, inventoryDna } = require("./mill-dna.cjs");
+
 const DEFAULT_PARAMS = {
   codex: "xray/codex.json",
   features: "xray/features.json",
@@ -436,20 +438,22 @@ function mintConsumerFromSsot(packageRoot, targetDir, log, tree) {
     },
     mintedAt: new Date().toISOString(),
   };
+  const withDna = attachInventoryDna(inventory);
   const xrayDir = path.join(targetDir, ".xray");
   if (!fs.existsSync(xrayDir)) fs.mkdirSync(xrayDir, { recursive: true });
   fs.writeFileSync(
     path.join(xrayDir, "foundry-inventory.json"),
-    `${JSON.stringify(inventory, null, 2)}\n`,
+    `${JSON.stringify(withDna, null, 2)}\n`,
   );
   if (log) {
     log("foundry-mint", "Minted foundry-inventory from consumer mill SSOT", "info", {
       consumer: consumer.name,
       version: consumer.version,
       suit,
+      dna: withDna.dna,
     });
   }
-  return inventory;
+  return withDna;
 }
 
 function mintConsumerSuit(millPackageRoot, targetDir, log) {
@@ -504,6 +508,8 @@ module.exports = {
   listProjectSkillDirs,
   mintConsumerFromSsot,
   mintConsumerSuit,
+  attachInventoryDna,
+  inventoryDna,
   isDogfood,
   readPackageIdentity,
   wornSkillNames,

package/scripts/foundry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xray/foundry",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "private": false,
   "type": "module",
   "description": "0xRay mill: mint their suit params, stamp, gate, publish, CI report, git hooks. Not the worn exo.",

package/scripts/foundry/plant/agents/inspect.yml

@@ -1,5 +1,5 @@
 name: inspect
 skill: inspect
 description: "Inspect AI work: diffs, traces, mill receipts, CI. Fastened mill plant."
-version: "0.1.8"
+version: "0.1.9"
 mode: subagent

package/scripts/foundry/plant/agents/mill.yml

@@ -1,5 +1,5 @@
 name: mill
 skill: mill
 description: "Fasten their plant as the suit. Factory Repertoire. Inspect is the mill discipline."
-version: "0.1.8"
+version: "0.1.9"
 mode: subagent

package/scripts/foundry/release-gate.mjs

@@ -66,7 +66,7 @@ function main() {
       }
     } else {
       step("1/7 Build", "npm run build");
-      step("2/7 Tests", "npm test");
+      step("2/7 Tests", "npm run test:comprehensive");
       if (!skipDocs) {
         step("3/7 Release docs", docsCheckCmd());
       }

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -9,7 +9,11 @@ import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface CodeReviewResult {
   file: string;
@@ -435,30 +439,24 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
-    const vote = await tryLLMGovernance(
-      "code-review",
-      proposalTitle,
-      proposalDescription,
-      evidence,
-      proposalType,
-    );
-
-    if (!vote) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-          },
-        ],
-      };
-    }
+    const vote =
+      (await tryLLMGovernance(
+        "code-review",
+        proposalTitle,
+        proposalDescription,
+        evidence,
+        proposalType,
+      )) ??
+      localConferVote({
+        role: "code-review",
+        llmConfigured: isGovernanceLlmConfigured(),
+      });
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+          text: formatGovernanceVoteText(vote),
         },
       ],
     };

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -8,7 +8,11 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface SecurityVulnerability {
   id: string;
@@ -995,30 +999,24 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
-    const vote = await tryLLMGovernance(
-      "security-audit",
-      proposalTitle,
-      proposalDescription,
-      evidence,
-      proposalType,
-    );
-
-    if (!vote) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-          },
-        ],
-      };
-    }
+    const vote =
+      (await tryLLMGovernance(
+        "security-audit",
+        proposalTitle,
+        proposalDescription,
+        evidence,
+        proposalType,
+      )) ??
+      localConferVote({
+        role: "security-audit",
+        llmConfigured: isGovernanceLlmConfigured(),
+      });
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+          text: formatGovernanceVoteText(vote),
         },
       ],
     };

package/src/mcps/researcher.server.ts

@@ -12,7 +12,11 @@ import { type CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
-import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
 import {
   buildMemoryRoutingEvidence,
@@ -472,39 +476,31 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
       enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
     }
 
-    const vote = await tryLLMGovernance(
-      "researcher",
-      proposalTitle || "",
-      proposalDescription || "",
-      enrichedEvidence,
-      proposalType || "",
-    );
+    const vote =
+      (await tryLLMGovernance(
+        "researcher",
+        proposalTitle || "",
+        proposalDescription || "",
+        enrichedEvidence,
+        proposalType || "",
+      )) ??
+      localConferVote({
+        role: "researcher",
+        llmConfigured: isGovernanceLlmConfigured(),
+        highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
+        recommendedAgent: memoryContext?.recommendedAgent,
+      });
 
     const memoryRoutingBlock =
       memoryContext?.confidence.highConfidenceTrapPresent
         ? `\n${formatMemoryRoutingBlock(memoryContext)}`
         : "";
 
-    if (!vote) {
-      const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
-        ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-        : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
-
-      return {
-        content: [
-          {
-            type: "text",
-            text: `DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: ${abstainReason}${memoryRoutingBlock}`,
-          },
-        ],
-      };
-    }
-
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${memoryRoutingBlock}`,
+          text: formatGovernanceVoteText(vote, memoryRoutingBlock),
         },
       ],
     };

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.8",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",