0xray 4.0.7 → 4.0.9

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.9",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/README.md

@@ -50,6 +50,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
+| **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
@@ -60,7 +61,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 ### Consolidations
 
-- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup.
+- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup. **4.0.9:** does not mill npm global prefix or `_npx`.
 - **7-server MCP surface** — `.mcp.json` SSOT; Grok plugin and all bridges share `XRAY_MCP_SERVERS`.
 - **Dev vs consumer AGENTS** — `AGENTS.md` (framework) vs `AGENTS-consumer.md` (copied to consumer projects on install).
 - **Release pipeline** — `npm run release:patch|minor|major` → reconcile → gate → artifacts → tag → publish.

package/dist/CHANGELOG.md

@@ -34,6 +34,26 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ---
 
+## [4.0.9] - 2026-09-11
+
+Postinstall does **not** mill npm global prefix or npx cache as a consumer. `resolveConsumerTargetDir` treats `_npx` and a prefix without `package.json` as an install prefix: mill `INIT_CWD` if it is a real project, else mill the 0xray package (dogfood skip). Isolated HOME still skips machine `~/.grok`. Mill plant stays `mill` + `inspect`. Not 45/42 costume. Nested mill stays **0.1.9**. Not 5.0.0.
+
+- fix(foundry): do not mill npm global prefix or npx cache as a consumer (b08b19612)
+
+---
+
+## [4.0.8] - 2026-09-11
+
+### 🔄 Changes
+
+### 🔎 Other Changes
+- fix(foundry): mill release gate uses test:comprehensive like mill CI (bd980ea3f)
+- fix(confer): allow undefined on optional local vote fields (e4436af8f)
+- fix(confer): abstain locally; do not rubber-stamp analyze_proposal (0f6c61cbe)
+- fix(confer): local vote when nested LLM is not configured (eb6004b07)
+
+---
+
 ## [4.0.7] - 2026-09-09
 
 Nested mill **0.1.9**. Inventory writes `dna` (keccak256 of canonical JSON without `mintedAt`). Inspect echoes dna + pack `0xray-suit`. Mill does not mint on chain. Not 5.0.0.

package/dist/README.md

@@ -50,6 +50,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
+| **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
@@ -60,7 +61,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 ### Consolidations
 
-- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup.
+- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup. **4.0.9:** does not mill npm global prefix or `_npx`.
 - **7-server MCP surface** — `.mcp.json` SSOT; Grok plugin and all bridges share `XRAY_MCP_SERVERS`.
 - **Dev vs consumer AGENTS** — `AGENTS.md` (framework) vs `AGENTS-consumer.md` (copied to consumer projects on install).
 - **Release pipeline** — `npm run release:patch|minor|major` → reconcile → gate → artifacts → tag → publish.

package/dist/governance/llm-governance-provider.d.ts

@@ -5,6 +5,7 @@ export interface GovernanceVote {
     reasoning: string;
 }
 export declare function resolveHermesBin(): string;
+export declare function isGovernanceLlmConfigured(): boolean;
 export declare function hermesCliAvailable(): boolean;
 export declare function tryLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceVote | null>;
 export declare function checkHermesOAuthStatus(): {

package/dist/governance/llm-governance-provider.js

@@ -94,6 +94,9 @@ function getConfig() {
     }
     return null;
 }
+export function isGovernanceLlmConfigured() {
+    return getConfig() !== null;
+}
 export function hermesCliAvailable() {
     try {
         execFileSync(resolveHermesBin(), ["--version"], {

package/dist/governance/local-confer.d.ts

@@ -0,0 +1,10 @@
+import type { GovernanceRole, GovernanceVote } from "./llm-governance-provider.js";
+export type LocalConferInput = {
+    role: GovernanceRole;
+    highConfidenceTrapPresent?: boolean | undefined;
+    recommendedAgent?: string | null | undefined;
+    llmConfigured?: boolean | undefined;
+};
+/** Receipt when nested LLM is absent or returned no vote. Never approve — analyze_proposal feeds mergeVotes. */
+export declare function localConferVote(input: LocalConferInput): GovernanceVote;
+export declare function formatGovernanceVoteText(vote: GovernanceVote, extra?: string): string;

package/dist/governance/local-confer.js

@@ -0,0 +1,27 @@
+/** Receipt when nested LLM is absent or returned no vote. Never approve — analyze_proposal feeds mergeVotes. */
+export function localConferVote(input) {
+    const role = input.role;
+    if (input.llmConfigured) {
+        return {
+            decision: "abstain",
+            confidence: 0.5,
+            reasoning: `Local confer (${role}); nested LLM configured but returned no vote.`,
+        };
+    }
+    if (input.highConfidenceTrapPresent) {
+        const agent = input.recommendedAgent?.trim() || "architect";
+        return {
+            decision: "abstain",
+            confidence: 0.62,
+            reasoning: `Local confer (${role}); nested LLM not configured. Repertoire high-confidence ontological trap — route to ${agent} before implementation.`,
+        };
+    }
+    return {
+        decision: "abstain",
+        confidence: 0.58,
+        reasoning: `Local confer (${role}); nested LLM not configured.`,
+    };
+}
+export function formatGovernanceVoteText(vote, extra = "") {
+    return `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${extra}`;
+}

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.4",
+  "version": "4.0.9",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -7,7 +7,8 @@
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
     constructor() {
         super("code-review", "3.1.0");
@@ -315,22 +316,16 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const vote = await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType);
-        if (!vote) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-                    },
-                ],
-            };
-        }
+        const vote = (await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType)) ??
+            localConferVote({
+                role: "code-review",
+                llmConfigured: isGovernanceLlmConfigured(),
+            });
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+                    text: formatGovernanceVoteText(vote),
                 },
             ],
         };

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -7,7 +7,8 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
     constructor() {
         super("security-audit", "3.1.0");
@@ -660,22 +661,16 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const vote = await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType);
-        if (!vote) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-                    },
-                ],
-            };
-        }
+        const vote = (await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType)) ??
+            localConferVote({
+                role: "security-audit",
+                llmConfigured: isGovernanceLlmConfigured(),
+            });
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+                    text: formatGovernanceVoteText(vote),
                 },
             ],
         };

package/dist/mcps/researcher.server.js

@@ -10,7 +10,8 @@
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
-import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
+import { isGovernanceLlmConfigured, tryLLMGovernance, } from "../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
 import { buildMemoryRoutingEvidence, formatMemoryRoutingBlock, resolveResearcherMemoryContext, } from "./researcher-confidence.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
@@ -390,28 +391,21 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
         if (memoryContext?.confidence.highConfidenceTrapPresent) {
             enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
         }
-        const vote = await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", enrichedEvidence, proposalType || "");
+        const vote = (await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", enrichedEvidence, proposalType || "")) ??
+            localConferVote({
+                role: "researcher",
+                llmConfigured: isGovernanceLlmConfigured(),
+                highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
+                recommendedAgent: memoryContext?.recommendedAgent,
+            });
         const memoryRoutingBlock = memoryContext?.confidence.highConfidenceTrapPresent
             ? `\n${formatMemoryRoutingBlock(memoryContext)}`
             : "";
-        if (!vote) {
-            const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
-                ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-                : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: ${abstainReason}${memoryRoutingBlock}`,
-                    },
-                ],
-            };
-        }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${memoryRoutingBlock}`,
+                    text: formatGovernanceVoteText(vote, memoryRoutingBlock),
                 },
             ],
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.7",
+  "version": "4.0.9",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/README.md

@@ -55,6 +55,8 @@ After mill plant is fastened, overlay their plant (defaults; remap in `foundry.j
 
 **Default mill plant:** `mill` + `inspect` (inspect AI work). Fastens a suit, not an empty one. Not 45/42 costume. `foundry.json` `"costume": true` copies that dump. Factory Repertoire still enable-when-resolves. PPE stays worn.
 
+**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Nested mill stays **0.1.9**.
+
 ## Publish this mill
 
 From **this directory**, not the 0xray repo root:

package/scripts/foundry/release-gate.mjs

@@ -66,7 +66,7 @@ function main() {
       }
     } else {
       step("1/7 Build", "npm run build");
-      step("2/7 Tests", "npm test");
+      step("2/7 Tests", "npm run test:comprehensive");
       if (!skipDocs) {
         step("3/7 Release docs", docsCheckCmd());
       }

package/scripts/node/install-bridges.cjs

@@ -27,23 +27,44 @@ const SKIP_DIRS = new Set(["node_modules", "logs"]);
 const MERGE_FILES = new Set(["enforcer-config.json"]);
 const KEEP_IF_EXISTS = new Set([".yml", ".yaml", ".md"]);
 
+function isInstallPrefixTarget(dir) {
+  const n = path.resolve(dir);
+  const norm = n.replace(/\\/g, "/");
+  if (norm.includes("/_npx/") || norm.endsWith("/_npx")) return true;
+  if (!fs.existsSync(path.join(n, "package.json"))) return true;
+  return false;
+}
+
 function resolveConsumerTargetDir(packageRoot, fallbackDir) {
   const resolved = path.resolve(packageRoot);
+  const fallback = path.resolve(
+    fallbackDir || process.env.INIT_CWD || process.env.PWD || process.cwd(),
+  );
   const inNodeModules =
     resolved.includes(`${path.sep}node_modules${path.sep}`) ||
     resolved.endsWith(`${path.sep}node_modules`);
 
+  let candidate;
   if (!inNodeModules) {
-    return fallbackDir || process.env.PWD || process.cwd();
+    candidate = fallback;
+  } else {
+    let current = resolved;
+    while (path.basename(current) !== "node_modules") {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        candidate = fallback;
+        break;
+      }
+      current = parent;
+    }
+    if (!candidate) candidate = path.dirname(current);
   }
 
-  let current = resolved;
-  while (path.basename(current) !== "node_modules") {
-    const parent = path.dirname(current);
-    if (parent === current) return fallbackDir || process.cwd();
-    current = parent;
+  if (isInstallPrefixTarget(candidate)) {
+    if (!isInstallPrefixTarget(fallback)) return fallback;
+    return resolved;
   }
-  return path.dirname(current);
+  return candidate;
 }
 
 function isConsumerInstall(packageRoot, targetDir) {
@@ -744,6 +765,7 @@ function installAllBridges(opts) {
 module.exports = {
   installAllBridges,
   resolveConsumerTargetDir,
+  isInstallPrefixTarget,
   syncBuiltinSkills,
   isConsumerInstall,
   deployXrayConfig,

package/scripts/node/postinstall.cjs

@@ -120,7 +120,10 @@ module.exports = {
 
 if (require.main === module) {
   const packageRoot = path.join(__dirname, "..", "..");
-  const targetDir = resolveConsumerTargetDir(packageRoot, process.env.PWD || process.cwd());
+  const targetDir = resolveConsumerTargetDir(
+    packageRoot,
+    process.env.INIT_CWD || process.env.PWD || process.cwd(),
+  );
   try {
     runPostinstall(packageRoot, targetDir);
   } catch {

package/scripts/node/setup.cjs

@@ -11,7 +11,10 @@ const {
   isConsumerInstall,
   deployXrayConfig,
 } = require("./install-bridges.cjs");
-let targetDir = resolveConsumerTargetDir(packageRoot, process.env.PWD || process.cwd());
+let targetDir = resolveConsumerTargetDir(
+  packageRoot,
+  process.env.INIT_CWD || process.env.PWD || process.cwd(),
+);
 
 const resolvedPackage = path.resolve(packageRoot);
 const resolvedTarget = path.resolve(targetDir);

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.4",
+  "version": "4.0.9",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -9,7 +9,11 @@ import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface CodeReviewResult {
   file: string;
@@ -435,30 +439,24 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
-    const vote = await tryLLMGovernance(
-      "code-review",
-      proposalTitle,
-      proposalDescription,
-      evidence,
-      proposalType,
-    );
-
-    if (!vote) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-          },
-        ],
-      };
-    }
+    const vote =
+      (await tryLLMGovernance(
+        "code-review",
+        proposalTitle,
+        proposalDescription,
+        evidence,
+        proposalType,
+      )) ??
+      localConferVote({
+        role: "code-review",
+        llmConfigured: isGovernanceLlmConfigured(),
+      });
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+          text: formatGovernanceVoteText(vote),
         },
       ],
     };

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -8,7 +8,11 @@
 import * as fs from "fs";
 import * as path from "path";
 import { XrayKnowledgeSkillBase } from "../shared/knowledge-skill-base.js";
-import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../../governance/local-confer.js";
 
 interface SecurityVulnerability {
   id: string;
@@ -995,30 +999,24 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
 
-    const vote = await tryLLMGovernance(
-      "security-audit",
-      proposalTitle,
-      proposalDescription,
-      evidence,
-      proposalType,
-    );
-
-    if (!vote) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
-          },
-        ],
-      };
-    }
+    const vote =
+      (await tryLLMGovernance(
+        "security-audit",
+        proposalTitle,
+        proposalDescription,
+        evidence,
+        proposalType,
+      )) ??
+      localConferVote({
+        role: "security-audit",
+        llmConfigured: isGovernanceLlmConfigured(),
+      });
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
+          text: formatGovernanceVoteText(vote),
         },
       ],
     };

package/src/mcps/researcher.server.ts

@@ -12,7 +12,11 @@ import { type CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
-import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
+import {
+  isGovernanceLlmConfigured,
+  tryLLMGovernance,
+} from "../governance/llm-governance-provider.js";
+import { formatGovernanceVoteText, localConferVote } from "../governance/local-confer.js";
 import { initializeMemoryRouting } from "../memory-routing/index.js";
 import {
   buildMemoryRoutingEvidence,
@@ -472,39 +476,31 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
       enrichedEvidence.push(...buildMemoryRoutingEvidence(memoryContext));
     }
 
-    const vote = await tryLLMGovernance(
-      "researcher",
-      proposalTitle || "",
-      proposalDescription || "",
-      enrichedEvidence,
-      proposalType || "",
-    );
+    const vote =
+      (await tryLLMGovernance(
+        "researcher",
+        proposalTitle || "",
+        proposalDescription || "",
+        enrichedEvidence,
+        proposalType || "",
+      )) ??
+      localConferVote({
+        role: "researcher",
+        llmConfigured: isGovernanceLlmConfigured(),
+        highConfidenceTrapPresent: memoryContext?.confidence.highConfidenceTrapPresent,
+        recommendedAgent: memoryContext?.recommendedAgent,
+      });
 
     const memoryRoutingBlock =
       memoryContext?.confidence.highConfidenceTrapPresent
         ? `\n${formatMemoryRoutingBlock(memoryContext)}`
         : "";
 
-    if (!vote) {
-      const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
-        ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-        : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
-
-      return {
-        content: [
-          {
-            type: "text",
-            text: `DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: ${abstainReason}${memoryRoutingBlock}`,
-          },
-        ],
-      };
-    }
-
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}${memoryRoutingBlock}`,
+          text: formatGovernanceVoteText(vote, memoryRoutingBlock),
         },
       ],
     };

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.9",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",