0xray 4.0.7 → 4.0.8

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.8",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/CHANGELOG.md

@@ -34,6 +34,18 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ---
 
+## [4.0.8] - 2026-09-11
+
+### 🔄 Changes
+
+### 🔎 Other Changes
+- fix(foundry): mill release gate uses test:comprehensive like mill CI (bd980ea3f)
+- fix(confer): allow undefined on optional local vote fields (e4436af8f)
+- fix(confer): abstain locally; do not rubber-stamp analyze_proposal (0f6c61cbe)
+- fix(confer): local vote when nested LLM is not configured (eb6004b07)
+
+---
+
 ## [4.0.7] - 2026-09-09
 
 Nested mill **0.1.9**. Inventory writes `dna` (keccak256 of canonical JSON without `mintedAt`). Inspect echoes dna + pack `0xray-suit`. Mill does not mint on chain. Not 5.0.0.

package/dist/governance/llm-governance-provider.d.ts

@@ -5,6 +5,7 @@ export interface GovernanceVote {
     reasoning: string;
 }
 export declare function resolveHermesBin(): string;
+export declare function isGovernanceLlmConfigured(): boolean;
 export declare function hermesCliAvailable(): boolean;
 export declare function tryLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceVote | null>;
 export declare function checkHermesOAuthStatus(): {

package/dist/governance/llm-governance-provider.js

@@ -94,6 +94,9 @@ function getConfig() {
     }
     return null;
 }
+export function isGovernanceLlmConfigured() {
+    return getConfig() !== null;
+}
 export function hermesCliAvailable() {
     try {
         execFileSync(resolveHermesBin(), ["--version"], {

package/dist/governance/local-confer.d.ts

@@ -0,0 +1,10 @@
+import type { GovernanceRole, GovernanceVote } from "./llm-governance-provider.js";
+export type LocalConferInput = {
+    role: GovernanceRole;
+    highConfidenceTrapPresent?: boolean | undefined;
+    recommendedAgent?: string | null | undefined;
+    llmConfigured?: boolean | undefined;
+};
+/** Receipt when nested LLM is absent or returned no vote. Never approve — analyze_proposal feeds mergeVotes. */
+export declare function localConferVote(input: LocalConferInput): GovernanceVote;
+export declare function formatGovernanceVoteText(vote: GovernanceVote, extra?: string): string;

package/dist/governance/local-confer.js

@@ -0,0 +1,27 @@
+/** Receipt when nested LLM is absent or returned no vote. Never approve — analyze_proposal feeds mergeVotes. */
+export function localConferVote(input) {
+    const role = input.role;
+    if (input.llmConfigured) {
+        return {
+            decision: "abstain",
+            confidence: 0.5,
+            reasoning: `Local confer (${role}); nested LLM configured but returned no vote.`,
+        };
+    }
+    if (input.highConfidenceTrapPresent) {
+        const agent = input.recommendedAgent?.trim() || "architect";
+        return {
+            decision: "abstain",
+            confidence: 0.62,
+            reasoning: `Local confer (${role}); nested LLM not configured. Repertoire high-confidence ontological trap — route to ${agent} before implementation.`,
+        };
+    }
+    return {
+        decision: "abstain",
+        confidence: 0.58,
+        reasoning: `Local confer (${role}); nested LLM not configured.`,
+    };
+}
+export function formatGovernanceVoteText(vote, extra = "") {
+    return `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${extra}`;
+}

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -7,7 +7,8 @@
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
     constructor() {
         super("code-review", "3.1.0");
@@ -315,22 +316,16 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const vote = await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType);
-        if (!vote) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-                    },
-                ],
-            };
-        }
+        const vote = (await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType)) ??
+            localConferVote({
+                role: "code-review",
+                llmConfigured: isGovernanceLlmConfigured(),
+            });
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+                    text: formatGovernanceVoteText(vote),
                 },
             ],
         };

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -7,7 +7,8 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
     constructor() {
         super("security-audit", "3.1.0");
@@ -660,22 +661,16 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const vote = await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType);
-        if (!vote) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-                    },
-                ],
-            };
-        }
+        const vote = (await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType)) ??
+            localConferVote({
+                role: "security-audit",
+                llmConfigured: isGovernanceLlmConfigured(),
+            });
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+                    text: formatGovernanceVoteText(vote),
                 },
             ],
         };

package/dist/mcps/researcher.server.js

@@ -10,7 +10,8 @@
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
-import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
 import { buildMemoryRoutingEvidence, formatMemoryRoutingBlock, resolveResearcherMemoryContext, } from "./researcher-confidence.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
@@ -390,28 +391,21 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
         if (memoryContext?.confidence.highConfidenceTrapPresent) {
             enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
         }
-        const vote = await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", enrichedEvidence, proposalType || "");
+        const vote = (await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", enrichedEvidence, proposalType || "")) ??
+            localConferVote({
+                role: "researcher",
+                llmConfigured: isGovernanceLlmConfigured(),
+                highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
+                recommendedAgent: memoryContext?.recommendedAgent,
+            });
         const memoryRoutingBlock = memoryContext?.confidence.highConfidenceTrapPresent
             ? `\n${formatMemoryRoutingBlock(memoryContext)}`
             : "";
-        if (!vote) {
-            const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
-                ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-                : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: ${abstainReason}${memoryRoutingBlock}`,
-                    },
-                ],
-            };
-        }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${memoryRoutingBlock}`,
+                    text: formatGovernanceVoteText(vote, memoryRoutingBlock),
                 },
             ],
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.7",
+  "version": "4.0.8",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/release-gate.mjs

@@ -66,7 +66,7 @@ function main() {
       }
     } else {
       step("1/7 Build", "npm run build");
-      step("2/7 Tests", "npm test");
+      step("2/7 Tests", "npm run test:comprehensive");
       if (!skipDocs) {
         step("3/7 Release docs", docsCheckCmd());
       }

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -9,7 +9,11 @@ import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface CodeReviewResult {
   file: string;
@@ -435,30 +439,24 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
-    const vote = await tryLLMGovernance(
-      "code-review",
-      proposalTitle,
-      proposalDescription,
-      evidence,
-      proposalType,
-    );
-
-    if (!vote) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-          },
-        ],
-      };
-    }
+    const vote =
+      (await tryLLMGovernance(
+        "code-review",
+        proposalTitle,
+        proposalDescription,
+        evidence,
+        proposalType,
+      )) ??
+      localConferVote({
+        role: "code-review",
+        llmConfigured: isGovernanceLlmConfigured(),
+      });
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+          text: formatGovernanceVoteText(vote),
         },
       ],
     };

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -8,7 +8,11 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface SecurityVulnerability {
   id: string;
@@ -995,30 +999,24 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
-    const vote = await tryLLMGovernance(
-      "security-audit",
-      proposalTitle,
-      proposalDescription,
-      evidence,
-      proposalType,
-    );
-
-    if (!vote) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-          },
-        ],
-      };
-    }
+    const vote =
+      (await tryLLMGovernance(
+        "security-audit",
+        proposalTitle,
+        proposalDescription,
+        evidence,
+        proposalType,
+      )) ??
+      localConferVote({
+        role: "security-audit",
+        llmConfigured: isGovernanceLlmConfigured(),
+      });
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+          text: formatGovernanceVoteText(vote),
         },
       ],
     };

package/src/mcps/researcher.server.ts

@@ -12,7 +12,11 @@ import { type CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
-import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
 import {
   buildMemoryRoutingEvidence,
@@ -472,39 +476,31 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
       enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
     }
 
-    const vote = await tryLLMGovernance(
-      "researcher",
-      proposalTitle || "",
-      proposalDescription || "",
-      enrichedEvidence,
-      proposalType || "",
-    );
+    const vote =
+      (await tryLLMGovernance(
+        "researcher",
+        proposalTitle || "",
+        proposalDescription || "",
+        enrichedEvidence,
+        proposalType || "",
+      )) ??
+      localConferVote({
+        role: "researcher",
+        llmConfigured: isGovernanceLlmConfigured(),
+        highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
+        recommendedAgent: memoryContext?.recommendedAgent,
+      });
 
     const memoryRoutingBlock =
       memoryContext?.confidence.highConfidenceTrapPresent
         ? `\n${formatMemoryRoutingBlock(memoryContext)}`
         : "";
 
-    if (!vote) {
-      const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
-        ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-        : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
-
-      return {
-        content: [
-          {
-            type: "text",
-            text: `DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: ${abstainReason}${memoryRoutingBlock}`,
-          },
-        ],
-      };
-    }
-
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${memoryRoutingBlock}`,
+          text: formatGovernanceVoteText(vote, memoryRoutingBlock),
         },
       ],
     };

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.8",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",