ruflo updates — week of 2026-08-02 (78 new commits, tip 913f9eaed)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-07-26 · Upstream tip: 913f9eaed

feat (15)

• f074987ea feat(security): implement ADR-377 — AgentDB Retrieval Security Layer (#2874) (rUv)
• 9cf769ccc feat: ship adaptive swarm and resolve top runtime issues (#2848) (rUv)
• dbb1f1e1d feat: capability brain and governed federation plane (#2825) (rUv)
• 495a451cf feat: add ADR-324 agentic policy engine (#2822) (rUv)
• fac48c7b7 feat(memory): typed provenance in AgentDB (ADR-323, corrects dream-cycle #2804) (#2820) (rUv)
• 0e3d41275 feat(flywheel): implement ADR-322 promotion loop (#2817) (rUv)
• 27410d402 feat(security): ADR-320 — MCP Composition Inspector v2 + ChannelGuard v2 (#2791) (rUv)
• 3280cf423 feat(swarm): inter-agent message compressor — IB+VQ MVP (#2727 dream) (ruv)
• 6568bedae feat(memory): OAS operator selector — budget-aware consolidation picker (#2763) (ruv)
• 79d266507 feat(memory): SCM query-intent classifier + routing hints (#2760 dream) (ruv)
• 746f2ccf6 feat(security): PlanFlip + MemPoison gates (#2752 dream-cycle) (ruv)
• 581cd2bf3 feat(security): ChannelGuard — inter-agent message injection scan (#2783 companion) (ruv)
• 381b7ebcc feat(security): MCP Composition Inspector — cross-tool prompt-injection scan (#2783) (ruv)
• d783b623c feat(hooks): route --mode moa emits Mixture-of-Agents fanout plan (#2778) (ruv)
• 46b33cb76 feat(swarm): SubagentPermissionDelegate — --with-permissions preset (#2768) (ruv)

fix (22)

• 30d49c6fe fix(agntcy): pin @agntcy/slim-bindings to the confirmed-working alpha (#2888) (rUv)
• 48d532b47 fix(hooks): honest routing scores, honest MoE metrics, real transfer (#2869) (rUv)
• 76453115a fix(security): fail closed on unvalidated security scan --depth/--type/--target (#2866) (Dragan Spiridonov)
• fabcc9261 fix(hooks): Codex hooks.json schema + PreToolUse verdict compat (#2857) (rUv)
• ad8d071d1 fix: stop daemon autostart in non-Ruflo projects (#2853) (rUv)
• 401e02d51 fix: complete reports and consistent initialization for v3.32.37 (#2851) (rUv)
• 67ff9898c fix: resolve current runtime and verification defects for v3.32.36 (#2850) (rUv)
• 0e957da3a fix(memory): migrate ADR-323 provenance_type on the bridge path, and stop the swallowed error surfacing as a WAL refusal (#2844) (Dragan Spiridonov)
• c1957608d fix(autopilot): enforce normalized CLI task sources (#2845) (rUv)
• 342dc22fc fix(flywheel): align ADR-322 safety envelope with the policy surface it guards (#2836) (Dragan Spiridonov)
• 872ca80a5 fix(autopilot): reject invalid task sources (#2838) (Dragan Spiridonov)
• 314ad1eb0 fix(release): terminate nested heredocs correctly (#2831) (rUv)
• 1385e21b2 fix(cli): preserve MCP description audit semantics (#2830) (rUv)
• ddd27576c fix(release): ship Capability Brain as a self-contained 3.32.30 train (#2829) (rUv)
• db76d6723 fix(metaharness): pin @metaharness/darwin + pin-drift guard (ruflo analog of upstream #142/#149) (#2813) (rUv)
• a440546e3 fix(codex): install ruflo-core@ruflo plugin on init --codex/--dual (#2801) (ruv)
• 310ab5f16 fix: reader/writer store mismatches — metrics, backup, swarm status (#2797 #2798 #2799) (ruv)
• 4467aeebb fix(memory): ADR-125 CLI-flag precedence over RUFLO_MEMORY_SCAN_ON_WRITE (#2794) (ruv)
• ff428388d fix(memory/embeddings): wire --type keyword|hybrid; ??-fix --threshold 0 (#2790) (ruv)
• 3b81e1c09 fix(parser): subcommand's non-boolean flag overrides global boolean set (ruv)
• 469a901ed fix(bridge): wire bridgeRecordFeedback to real intelligence.recordTrajectory (#2786 fix-3) (ruv)
• 810b13dcd fix: tracker-sweep 2026-07-26 (v3.32.10) — 9 bugs + promo seed + follow-ups (#2788) (rUv)

docs (6)

• e3a403e9f docs(adr): add ADR-377 — AgentDB Retrieval Security Layer (#2872) (rUv)
• 5f8111246 docs(adr): consolidate 49 stale dream-cycle proposals, renumber ADR-334..376 (#2871) (rUv)
• b52f54beb docs: NPM_TOKEN publish path restored (granular access token) (#2868) (rUv)
• 503b64732 docs: confirm npm publish WebAuthn procedure from v3.32.39 release (#2861) (rUv)
• 6143e1e6e docs: document npm publish OTP/automation-token gotcha (#2860) (rUv)
• b9010cb22 docs: drop unverified Flash Attention speedup claim from CLAUDE.md (#2739 dream-cycle) (ruv)

chore (27)

• 913f9eaed chore(data): clone snapshot ruflo updates — week of 2026-07-05 (41 new commits, tip a5f86ad0a) #11 — 0 clones (14d) (ruflo-bot)
• 4ac1ab9ff chore(release): re-sign helpers manifest for v3.34.0 (ruv)
• 9668fd108 chore(release): bump to 3.34.0 — AGNTCY/Outshift runtime integration (ruv)
• 491c75a6f chore(release): 3.33.0 — ADR-377 AgentDB Retrieval Security Layer (#2876) (rUv)
• 3d9bca6d4 chore(release): prepare v3.32.35 (#2849) (rUv)
• c3cf2d0ea chore(release): harden memory migration for v3.32.34 (#2846) (rUv)
• 388849b3e chore(release): prepare v3.32.32 (#2842) (rUv)
• 77b8dabb9 chore(release): prepare v3.32.31 (#2841) (rUv)
• 1d305b133 chore(release): correct stable train to v3.32.29 (#2826) (rUv)
• b08246b04 chore(release): bump to 3.32.27 (#2823) (rUv)
• a158418a8 chore(release): @claude-flow/codex 3.0.2 — ships #2801 plugin install (ruv)
• c50581b41 chore(release): bump to 3.32.24 (ruv)
• 7b5e7d846 chore(release): bump to 3.32.23 (ruv)
• e263c269d chore(release): bump to 3.32.22 (ruv)
• fa6f9429f chore(data): clone snapshot ruflo updates — week of 2026-06-28 (183 new commits, tip a63cdf052) #10 — 0 clones (14d) (ruflo-bot)
• 6b6eef90c chore(release): bump to 3.32.21 (ruv)
• 353d06637 chore(release): bump to 3.32.20 (ruv)
• 7e76906ff chore(release): bump to 3.32.19 (ruv)
• 684ca3bfc chore(release): bump to 3.32.18 (ruv)
• a0a4f165f chore(release): bump to 3.32.17 (ruv)
• de9736a67 chore(release): bump to 3.32.16 (ruv)
• fc88555f7 chore(release): bump to 3.32.15 (ruv)
• 8a884a060 chore(release): bump to 3.32.14 (ruv)
• a17a597b6 chore(release): bump @claude-flow/cli, claude-flow, ruflo to 3.32.13 (ruv)
• 13a3421f5 chore(release): bump @claude-flow/cli, claude-flow, ruflo to 3.32.12 (ruv)
• 2aec43f61 chore(release): bump @claude-flow/cli, claude-flow, ruflo to 3.32.11 (ruv)
• 8bc23e76e chore(release): bump @claude-flow/cli, claude-flow, ruflo to 3.32.10 (ruv)

build (1)

• b8ec03f34 build(deps): promote metaharness + @metaharness/router to hard dependencies (ADR-321) (ruv)

ci (2)

• 74c5b2244 ci: publish three-package stable train (#2827) (rUv)
• 16c1ae504 ci: add idempotent stable npm release workflow (ruv)

other (5)

• 791d24b36 ADR-380 correction: real @agntcy/slim-bindings package + 2 upstream bugs filed (#2880) (rUv)
• 1e64c2fd3 ADR-378/379/380: npm Trusted Publishing, statusline segments, AGNTCY/Outshift runtime integration (#2879) (rUv)
• e549cadb1 Update README.md (rUv)
• f541d65a0 dream(performance): #2862 nightly research — Two Calls Beat Five Agents 7.4× token gap + HalluProp pre-hoc failure inference (ADR-333) (#2863) (rUv)
• 331caa71e Merge pull request #2824 from ruvnet/chore/stable-npm-release-workflow (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)