v3.35.0 — MetaHarness dependency-contract repair + ADR-381 sequential-evidence governance

v3.35.0 — MetaHarness dependency-contract repair + ADR-381 sequential-evidence governance

What's in this release

• #2956 — Fixes a dependency-contract bug where a clean ruflo install shipped with zero MetaHarness packages on disk (they were declared as optional peer dependencies, which npm never auto-installs). MetaHarness packages are now explicit optionalDependencies, tilde-pinned, with a mandatory clean-install CI gate.
• #2956 — Adds strict, statistically-governed evidence requirements (ADR-381) to the self-optimizing flywheel's promotion gate, bounding the family-wise false-promotion probability at ≤5% across an adaptively-chosen candidate stream.
• Follow-up fix on #2956 — Code review of the PR before merge found and fixed 3 confirmed concurrency/epoch-boundary bugs in the new sequential-evidence machinery that could silently violate that ≤5% guarantee under concurrent or decoupled evaluation/registration timing. See the companion write-up for the full story in plain language:
  👉 https://gist.github.com/ruvnet/0202e6a060b04b3a4f5d9bd18345169d
• #2957 — Version bump housekeeping + a stale test assertion fix (distill-oracle.test.ts — a version-pinned command no longer matched the test's un-pinned substring check).

Upgrade

npx ruflo@latest --version   # 3.35.0
npx @claude-flow/cli@latest doctor --component metaharness

No breaking changes — this is a backward-compatible minor release (new optional dependencies, new doctor checks, new CLI/MCP surface for flywheel evidence-reset).

Verification

All three packages (@claude-flow/cli, claude-flow, ruflo) published at 3.35.0 with latest/alpha/v3alpha dist-tags aligned, verified via npm view <pkg> dist-tags --json and a live npx ruflo@latest --version smoke test.

🤖 Generated with RuFlo

v3.34.0 — AGNTCY/Outshift runtime integration

AGNTCY/Outshift runtime integration (ADR-378/379/380)

Optional, removable augmentation per ADR-150's pattern — the kernel stays fully
operational with these packages absent.

• New CLI verbs: ruflo transport use slim, ruflo agent publish, ruflo swarm join <namespace>.
  All exit 0 with a clear message when RUFLO_AGNTCY_SLIM_ENDPOINT is unset — no fake success paths.
• CASA (Continuous Agentic Semantic Authorization) — deterministic free-text-objective →
  bounded allow/deny/budget/expiry envelope compiler, deny-by-default enforcement gate,
  Ed25519-signed decision receipts (.swarm/casa-receipts.jsonl).
• AGNTCY OTel span attributes — coordination.episode, authorization.decision.
• Companion Rust crate v3/crates/ruflo-agntcy mirrors the TS enforcement logic (real
  in-process LocalTransport, SlimTransport stub behind a non-default slim Cargo feature).
• Companion package @metaharness/agntcy
  (build-time half — identity, OASF export, Directory publish, semantic observability) published
  for the first time from the sibling metaharness repo.
• See it in action: AGNTCY showcase — a real trace
  and the presentation deck.

npm Trusted Publishing release workflow (ADR-378)

.github/workflows/stable-npm-release.yml publishes the three-package stable train
(@claude-flow/cli, claude-flow, ruflo) from an immutable, tag-pinned checkout with a full
test/build/pack/install smoke-test gate before any registry write, verifies published-package
integrity against the locally-built archive, and rolls out latest/alpha/v3alpha dist-tags
together. This release is the first real run of that workflow.

Fixed

• @agntcy/slim-bindings pinned to the confirmed-working alpha (2.0.0-alpha.5) — the SLIM
  maintainers moved off uniffi-bindgen-react-native (incompatible with plain Node) onto
  @ubjs/core/@ubjs/node; verified live end-to-end.
• security scan failed open on unvalidated --depth/--type/--target — all three now fail
  closed before anything is scanned or written.

Changed / Removed

• security scan --depth full deprecated (normalises to deep with a warning).
• security scan --type container now rejected instead of silently reporting clean (breaking
  for pipelines passing --type container).

Full changelog: CHANGELOG.md

---

Install: npx ruflo@latest doctor · npx ruflo@latest agent publish --help

ADR-378/379/380 — npm Trusted Publishing, statusline segments, AGNTCY/Outshift integration

Merge marker for PR #2879 — not an npm version release (@claude-flow/cli/claude-flow/ruflo remain at 3.33.0 on npm).

Full consolidated release notes: https://gist.github.com/ruvnet/d6fc9bea2758049fd87424a2718dec1e

See it illustrated: ruflo × AGNTCY — an animated walkthrough

Three ADRs merged: npm Trusted Publishing proposal (ADR-378), optional statusline usage segments (ADR-379), and AGNTCY/Outshift runtime integration with real, tested CASA envelope enforcement + CLI scaffolding (ADR-380). Companion: ruvnet/metaharness PR #155 (ADR-240).

An adversarial security review found and PR #2879 fixed two real bugs in the CASA enforcement gate before merge — see the gist for details.

Update: PR #2888 pins @agntcy/slim-bindings to the confirmed-working pre-release build (2.0.0-alpha.5) — verified live, a real SLIM server/client bring-up now succeeds under plain Node with zero errors. Not yet in an npx ruflo@latest release; build from main to try it today.

v3.33.0 — ADR-377: AgentDB Retrieval Security Layer

AgentDB Retrieval Security Layer (ADR-377)

Closes #2516 / tracked in #2873: AgentDB's retrieval and write paths had zero certified defenses against memory poisoning (undefended attack success 93–100% per SMSR, arXiv:2606.12703). Full 3-phase implementation shipped in #2874, all off by default until independently benchmarked.

• AgentDbRetrievalGuard (@claude-flow/memory) — filters HNSW retrieval results through ToolOutputGuardrail's OWASP LLM01/LLM08 pattern scan before context assembly. CLAUDE_FLOW_RETRIEVAL_GUARD / _STRICT.
• MemoryPoisonForensics (@claude-flow/hooks) — rolling-window z-score anomaly detection on AgentDB write sequences (write-interval, content-length). CLAUDE_FLOW_POISON_FORENSICS=0 to disable.
• McpCallerIdentity (@claude-flow/security) — Ed25519 per-invocation capability tokens. CLAUDE_FLOW_MCP_CALLER_AUTH, off by default pending a follow-on key-distribution ADR.

Also in this release:

• #2871 — consolidated 49 stale dream-cycle research proposals (open since 2026-05-29, never merged) into ADR-334 through ADR-376, resolving the ADR-147/ADR-179/ADR-320 numbering collisions along the way.
• #2872 — recovered ADR-377 itself from an abandoned dream-cycle branch that never got a PR opened for it.

31 new tests across the three touched packages, zero regressions (memory 451, hooks 145, security 570 full suites re-run clean).

Packages

• @claude-flow/cli@3.33.0
• claude-flow@3.33.0
• ruflo@3.33.0

🤖 Generated with Claude Code

v3.32.41 — honest routing scores, honest MoE metrics, real pattern transfer

Fixed

#2864 — hooks route gated learned routing patterns at score ≥0.65 vs static patterns at >0.4, so a top-scoring learned pattern could lose to a lower-scoring static one that simply cleared the easier bar. Measured 49% agreement with the router's own recorded training labels on a real store (only 1/61 replayed routes decided by a learned pattern). Both sources now share the same score gate; support/reliability remain the learned-specific quality guard.

#2865 — the hooks intelligence MoE panel showed a hardcoded Routing Accuracy: 82.0% (plus Active Experts/Load Balance constants) whenever any local neural data existed, regardless of actual routing quality — the same "self-confidence presented as accuracy" problem already fixed on the hooks metrics path in an earlier release. These fields are now omitted rather than fabricated when no real value is reported.

#2859 — hooks transfer from-project reported success and quality stats (avgConfidence, avgAge) without ever reading or writing the destination project's memory store — every number was invented from fixed percentages of the source pattern count. Now performs a real merge: reads the destination, skips low-confidence/duplicate/conflicting entries, and actually persists whatever remains. Reported counts and stats are computed from what was actually processed.

All three verified against the exact reproductions in their issues using the real built CLI (not unit mocks).

PR: #2869

Packages

`@claude-flow/cli`, `claude-flow`, and `ruflo` are all at 3.32.41; `latest`, `alpha`, and `v3alpha` dist-tags all point to it.

v3.32.40 — security scan fail-closed on invalid --depth/--type/--target

Fixed

Security (reported privately via SECURITY.md, external reproduction + patch): ruflo security scan validated none of its --depth, --type, or --target flags. An unrecognised value did not error — it silently reduced or eliminated the scan while still printing "No security issues found!" and exiting 0. On a fixture whose only HIGH finding sat below the shallow-traversal budget, --depth full → --depth full (the CLI's own emitted value) silently flipped the critical/high exit-code gate from 1 to 0, and a typo'd --target produced a persisted CLEAN report that downstream status checks trusted as genuine.

All three flags now fail closed before anything is scanned or written:

• --depth/--type validated against exhaustive Record<ScanDepth, number> maps with real type predicates (no unsafe casts that could silently re-disable the recursion limiter)
• --depth full (never a real value, but emitted by the CLI's own statusline/announcements/generated CLAUDE.md/shipped agents) is deprecated-but-accepted → deep, with a warning, rather than breaking every caller told to use it
• --type container (advertised but never implemented) now hard-rejects instead of silently reporting clean — breaking for any pipeline passing it, previously exited 0
• --target validated for existence and directory-ness

246 lines of new tests cover depth-budget boundaries by nesting level, case sensitivity, a path-traversal-via---type attempt, stdout/stderr separation, and no-persisted-report-on-rejection.

PR: #2866

Packages

`@claude-flow/cli`, `claude-flow`, and `ruflo` are all at 3.32.40; `latest`, `alpha`, and `v3alpha` dist-tags all point to it.

v3.32.39 — Codex hooks.json + PreToolUse verdict compat

Fixes

#2855 — Codex's plugin hook-manifest loader accepts only description and hooks at the top level. plugins/ruflo-core/hooks/hooks.json and plugins/ruflo-cost-tracker/hooks/hooks.json carried _note/_platform_note documentation fields, so a fresh Codex install of ruflo-core@ruflo failed to load the plugin at all with unknown field \_note`, expected `description` or `hooks`. Fixed by folding the doc content into description. Added a permanent CI guard (scripts/audit-plugin-hooks-cross-platform.mjs`) so this can't regress silently again.

#2856 — Once the manifest could load, modify-bash/modify-file PreToolUse hooks always echoed Cursor's {"permission":"allow"} verdict, which Codex's own stricter output schema rejects outright (hook returned invalid pre-tool-use JSON output) — verified directly against the real parser (codex-rs/hooks/src/engine/output_parser.rs). Hardened Codex-host detection with a turn_id-based fallback alongside the existing PLUGIN_ROOT/PLUGIN_DATA env-var check.

ruflo-core bumped 0.2.5 → 0.2.6 and ruflo-cost-tracker 0.26.2 → 0.26.3 so Codex's per-version plugin cache invalidates and picks up the fix rather than serving a stale cached copy indefinitely.

PR: #2857

Packages

`@claude-flow/cli`, `claude-flow`, and `ruflo` are all at 3.32.39; `latest`, `alpha`, and `v3alpha` dist-tags all point to it.

Ruflo v3.32.38 — Daemons Start Only for Ruflo Projects

Ruflo v3.32.38: Daemons Start Only for Ruflo Projects

Ruflo v3.32.38 fixes a background-process leak discovered during the
post-release audit: a read-only command in a directory containing only a
Claude Code .claude/ folder could start a detached Ruflo daemon.

The trigger was subtle. Signed-champion startup migration created a
.claude-flow/ state directory, and daemon auto-start then mistook that
startup-created directory for prior user initialization. Repeated commands in
unrelated Claude projects could therefore accumulate one daemon per directory.

Install or upgrade

npm install --global ruflo@3.32.38
ruflo --version

What changed

Daemon auto-start now requires a durable Ruflo project marker:

• a Ruflo runtime config under .claude-flow/;
• a legacy claude-flow.config.json;
• an initialized .swarm/memory.db;
• a Ruflo-specific Claude settings section; or
• a Ruflo/Claude Flow MCP server entry.

A generic .claude/ directory, an empty .claude-flow/ directory, or policy
state created during the current startup no longer authorizes a detached
process. Explicit ruflo daemon start remains available everywhere, and
initialized Ruflo projects retain automatic background workers.

Validation

• The exact issue reproduction was run against 3.32.37 and produced a daemon.
• The same reproduction against the patched build produced no process and no
  daemon PID file, even though signed-champion and policy state were applied.
• Daemon auto-start regression suite: 13/13.
• CLI TypeScript build passes.
• The stable release pipeline builds immutable archives, smoke-installs all
  three public packages, publishes those same bytes, and verifies a fresh
  registry installation.

This release resolves
#2852.

Ruflo v3.32.37 — Complete Reports, Consistent Initialization

Ruflo v3.32.37: Complete Reports, Consistent Initialization

Ruflo v3.32.37 closes the follow-up defects found while verifying v3.32.36
against older open bug reports. MetaHarness readiness verdicts remain
machine-readable even when a repository is blocked, memory initialization
uses the same configured database path as every later operation, and dual
Claude Code/Codex initialization now installs both native surfaces.

The release also removes unbacked Codex skill placeholders, makes ADR indexing
idempotent, repairs legacy live-memory row visibility, and bounds the
quadratic work in session-end intelligence consolidation.

Install or upgrade

npm install --global ruflo@3.32.37
ruflo doctor

Existing projects remain compatible. The stable train still contains exactly
the three supported packages: @claude-flow/cli, claude-flow, and ruflo.

MetaHarness readiness is data

ruflo metaharness genome --path . --format json

Upstream MetaHarness intentionally uses exit 1 for needs-work and exit 2 for
blocked. Ruflo now preserves those valid reports instead of replacing them
with a generic subprocess error:

{
  "risk_score": 0.72,
  "verdict": "blocked",
  "verdictExitCode": 2
}

The Ruflo wrapper exits successfully for a valid report so CLI and MCP callers
can consume it. --alert-on-risk-above still exits 1 when its policy threshold
is crossed, and malformed or missing reports still fail with exit 2.

Initialization and portability

• memory init honors CLAUDE_FLOW_DB_PATH, completing the shared-path
  contract used by dual-mode bootstrap and background workers.
• init --dual runs both native initializers, preserving the full Claude Code
  scaffold while adding Codex assets.
• Root .gitignore protection covers .env secrets in initialized projects.
• Codex full init installs canonical skill implementations only; it no longer
  generates more than one hundred placeholder skills that appear usable but
  have no implementation.
• Every tracked shell and Windows hook shim now resolves the same stable Ruflo
  dist-tag.

ADR and memory correctness

• ADR metadata parsing accepts the bullet-prefixed Date, Tags, and relationship
  format emitted by adr-create.
• ADR records use explicit upsert semantics and stable keys.
• ADR relationships use deterministic semantic keys and are deduplicated
  within an import, while verification remains compatible with legacy keys.
• ADR creation guidance uses the real AgentDB key/value contract.
• Native memory CRUD treats legacy NULL status rows consistently as live.
• Intelligence consolidation deduplicates by content before graph creation and
  caps similarity comparisons while preserving temporal edges.

Validation

• Blocked-genome CLI and MCP fixtures preserve the complete verdict.
• ADR smoke: 22/22; hook-shim smoke: 12/12.
• Release gates: 12 CLI contract, 238 Codex, 559 security, and 640
  federation tests pass.
• All 23 buildable V3 workspace packages compile successfully.
• Focused MetaHarness, memory-path, dual-init, canonical-skill, ADR parser,
  ADR idempotency, memory visibility, and consolidation regressions pass.
• The stable release workflow builds immutable archives, tests the bundled
  policy/Codex/federation runtimes, installs all three archives, publishes the
  same bytes, and installs them again from the npm registry.

This patch resolves
#2626,
#2629,
#2600,
#2634,
#2636,
#2637,
#2660,
#2659,
#2651,
#2628, and
the remaining active-row visibility defect in
#2652.

Ruflo v3.32.36 — Trustworthy Signals, Portable Codex Workflows

Ruflo v3.32.36: Trustworthy Signals, Portable Codex Workflows

Ruflo v3.32.36 makes the information an agent sees line up with what the
runtime is actually doing. Embedding commands now disclose when they are using
the deterministic mock fallback, routing metrics distinguish confidence from
measured outcomes, swarm status reads canonical agent state, and learned
patterns preserve the task description that caused them.

The release also makes mixed Claude Code and Codex installations easier to
operate. Codex receives a native read-only Ruflo status skill, dual-mode memory
workers share one database path, large MCP catalogs can be filtered for
small-context models, and project/plugin hook overlap is claimed exactly once.
Hermetic witness verification and Node 24 MCP images strengthen the release
path without adding a runtime dependency.

Install or upgrade

npm install --global ruflo@3.32.36
ruflo doctor

Existing projects remain compatible. The default MCP tool set is unchanged,
legacy memory state remains readable, explicit database-path overrides are
preserved, and mock embeddings remain available. The difference is that
degraded or unmeasured states are now reported honestly instead of being
presented as grounded semantic results or routing accuracy.

Use a smaller MCP catalog

Keep the default full catalog:

ruflo mcp start

Or select only the capabilities a constrained model needs:

ruflo mcp start --tools memory,swarm,hooks

The equivalent environment form is useful in MCP host configuration:

CLAUDE_FLOW_MCP_TOOLS=memory,swarm,hooks ruflo mcp start

Selectors accept categories, tool-name prefixes, and exact tool names. Ruflo
doctor now reports catalog/schema overhead so the selection can be measured.

Inspect grounded learning state

ruflo embeddings status
ruflo hooks metrics
ruflo swarm status
ruflo doctor --component memory

embeddings status identifies the active backend and whether semantic claims
are grounded. Hook metrics expose average confidence and observed outcome
success separately. The memory doctor checks structural integrity, content and
embedding coverage, Reflexion episode coverage, and feedback critiques.

To populate or repair the derived reasoning tables from existing memory:

ruflo memory distill run
ruflo memory distill status

Raw memory_entries and the SONA feed remain the operational write path.
reasoning_patterns, episodes, embeddings, critiques, and causal edges are
derived intelligence populated by distillation or the consolidate worker.

Codex and dual-mode projects

After initialization, Codex can invoke the native ruflo-status skill without
receiving Cursor-specific permission JSON. Dual-mode workers now use a shared
CLAUDE_FLOW_DB_PATH, including worker subprocesses and relative configuration
files, so bootstrap, writes, reads, policy checks, and background work observe
the same database.

The packaged Codex skill set now includes:

• swarm orchestration;
• memory management;
• SPARC methodology;
• security audit;
• GitHub automation;
• performance analysis.

Security and verification

• Witness signature verification uses Node's built-in Ed25519 support in a
  source-only checkout and preserves the legacy exit-2 precondition for an
  unbuilt full-tree verification.
• Helper signing has one public-key source, supports a piped stdin key, uses
  gcloud.cmd on Windows, validates Ed25519 keys, and redacts failures.
• MCP bridge images use the supported Node 24 LTS line.
• MetaHarness wrappers preserve structured HIGH findings when the upstream
  scanner exits non-zero.
• Root and packaged hook helpers are byte-identical and covered by a signed
  four-helper manifest.

What changed

• Reports the actual embedding backend and suppresses unsupported semantic
  interpretations while the mock fallback is active.
• Replaces misleading “Routing Accuracy” output with average confidence and
  measured outcome-success signals.
• Fixes learned-pattern success/failure counts and retains task descriptions in
  the learning write.
• Reads canonical per-agent IDs and statuses for agent list and
  swarm status.
• Fixes statusline install discovery, numeric version comparison, project-root
  resolution, and legacy nested-intelligence migration.
• Keeps non-TTY spinner output clean and erases TTY spinner lines correctly.
• Deduplicates overlapping project/plugin post-edit and session-end side
  effects using an atomic event claim.
• Adds MCP tool filtering and schema-overhead diagnostics.
• Repairs dual-mode Codex memory-path consistency and packaged skill assets.
• Adds memory distillation episode embeddings, historical backfill, critique
  preservation, and strict doctor coverage checks.

Validation

• All 23 V3 workspace packages built successfully.
• 171 changed-surface CLI tests passed.
• Codex passed 235 tests, security passed 559, and federation passed 640.
• Ruflo core hook integration passed 22/22, including duplicate-event
  exactly-once behavior.
• MetaHarness passed its complete plugin regression matrix, including
  structured finding preservation.
• Helper signing security, hermetic witness, MCP security lock, scan-format,
  and 37 release invariants passed.
• The stable release workflow additionally installs and tests immutable tarball
  archives for @claude-flow/cli, claude-flow, and ruflo before publishing
  those exact bytes.

This release resolves the current runtime and verification defects tracked in
#2847,
#2821,
#2818,
#2816,
#2814,
#2812,
#2811,
#2810,
#2809,
#2808,
#2807,
#2805,
#2766,
#2765,
#2750,
#2729,
#2726,
#2677,
#2675, and
#2674.