ruflo

Ruflo v3.32.30: Capability Brain, Now Complete in the Public Install

Ruflo can coordinate hundreds of agent, memory, policy, federation, and MetaHarness capabilities—but users should not have to memorize that surface or install unpublished internal packages to make it work. v3.32.30 makes the public install self-contained and teaches newly initialized agents how to use the system safely.

This is a corrective release for v3.32.29. That package exposed the new policy runtime through a static @claude-flow/security import while declaring the unpublished package optional. Fresh installs could run --version, but policy and daemon command loading failed with ERR_MODULE_NOT_FOUND. v3.32.30 embeds the reviewed Security, Codex, and federation runtimes in each applicable public artifact and promotes their public transitive dependencies to the containing package.

What this enables

• Ask guidance_brain which registered Ruflo capabilities fit a task instead of guessing tool names.
• Run the full policy ledger, daemon, MCP, and standard CLI command surface from a fresh three-package installation.
• Generate CLAUDE.md and AGENTS.md instructions that use the Capability Brain, the validated implementation loop, isolated concurrent writers, source-bound evidence, and non-expanding authority envelopes.
• Initialize Codex projects from the bundled adapter, including its built-in skills, without requiring a standalone @claude-flow/codex publication.
• Discover the bundled federation foundation without requiring a standalone federation package. Production federation still requires deployment-specific durable storage, identity, policy, and acceptance testing.

Install or upgrade

npm install --global ruflo@3.32.30
ruflo doctor

Or run without a global install:

npx ruflo@3.32.30 --help

Use the Capability Brain

From an MCP client:

{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement, test, benchmark, and review this change with concurrent agents"
  }
}

The returned workflow follows:

recall → inspect → route → plan → execute → test → validate
       → benchmark → optimize → receipt → handoff → authorized publish

Learning, Darwin, Flywheel, and MetaHarness can propose or evaluate candidates. They cannot promote themselves or expand tools, network access, secrets, spending, concurrency, or release authority.

Concurrent development defaults

Generated guidance now requires:

• one isolated worktree and explicit file scope per writing agent;
• shared checkouts only for read-only research;
• one integration owner for shared manifests, lockfiles, and overlap reconciliation;
• continued independent work after spawning agents rather than stopping;
• tests, benchmarks, policy decisions, and handoffs bound to an exact clean commit or immutable dirty-worktree snapshot.

Public package train

The normal release publishes exactly:

• @claude-flow/cli@3.32.30
• claude-flow@3.32.30
• ruflo@3.32.30

The Security, Codex, and federation runtimes are built from the reviewed monorepo source and carried as npm bundled dependencies inside the CLI and umbrella artifacts. Their source package coordinates are not published as part of this release.

Compatibility

• Existing projects are never overwritten by init unless --force is used.
• Existing guidance MCP tools remain available when guidance_brain is absent.
• Policy migration remains legacy by default; operators can move through observe before enforce.
• Optional native keychain, AgentDB, neural, and MetaHarness dependencies retain their existing graceful-degradation behavior.
• ruflo, claude-flow, and @claude-flow/cli remain version-locked and install through their established command names.

Validation contract

Release acceptance requires:

• the three-package version lockstep audit;
• focused generated-guidance and Codex adapter tests;
• Security, Codex, and federation builds and tests;
• tarball inspection proving all three internal runtimes are bundled;
• fresh tarball installation with optional dependencies omitted;
• --version, policy status, daemon start/status/stop, and init --codex smoke tests;
• npm ls without invalid dependency edges;
• registry verification and aligned latest, alpha, and v3alpha tags.

Ruflo v3.32.29: Capability Brain — Corrected Stable Train

v3.32.29 is the corrective stable publication of the Capability Brain work first preserved in the immutable v3.32.28 source release. The v3.32.28 npm train was not published: its release credential was rejected, and the intended federation 1.0.0-alpha.17 coordinate was already occupied by an older artifact. Ruflo did not move the existing tag or reuse the immutable package coordinate.

This release advances ruflo, claude-flow, and @claude-flow/cli to 3.32.29, advances the federation plugin to 1.0.0-alpha.18, and retains the reviewed @claude-flow/security@3.0.0-alpha.14 and @claude-flow/codex@3.0.3 components. The original release and its end-user gist remain intact. The corrected end-user guide is available as a separate v3.32.29 gist.

Ruflo has grown into a large agentic runtime, but its old MCP guidance catalog only knew about 61 of the 353 tools available in a fully equipped process. That made powerful features hard to discover and made agents more likely to guess at stale tool names.

v3.32.29 publishes the Ruflo Capability Brain: a live, machine-readable map of the MCP registry, CLI commands, agents, skills, packages, plugins, authority boundaries, risk, and the end-to-end implementation loop. Agents can now ask Ruflo which capabilities fit a task and automatically choose from tools that are actually registered in the current process.

What you can use it for

• Discover every MCP tool registered in your running Ruflo server.
• Route a task to suitable tools, agents, skills, and a swarm topology.
• Find capabilities across .claude, .agents, installed packages, and Ruflo plugins.
• Keep optional or remote integrations honest: registered, configured, reachable, healthy, and authorized are reported as different facts.
• Guide autonomous development through recall, inspection, planning, implementation, testing, validation, benchmarking, optimization, evidence, handoff, and authorized publication.
• Distinguish policy authorization, exclusive work claims, content-safety evidence, memory learning, consensus, and release authority.
• Route Cognitum identity through the implemented PKCE/OOB profile lifecycle, while reporting RFC 8628 polling and server-side logout revocation as unavailable instead of guessing.

Try the Capability Brain

In Codex, Claude Code, or another MCP client, ask the agent:

Use Ruflo guidance_brain to recommend the best workflow for implementing this task, then follow the returned implementation loop.

Or call the MCP tool directly:

{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement a secure API change with concurrent agents, tests, benchmarks, and a release"
  }
}

Useful modes:

{"name":"guidance_brain","arguments":{"mode":"overview"}}
{"name":"guidance_brain","arguments":{"mode":"capabilities","domain":"memory-knowledge"}}
{"name":"guidance_brain","arguments":{"mode":"coverage"}}
{"name":"guidance_brain","arguments":{"mode":"ecosystem"}}
{"name":"guidance_brain","arguments":{"mode":"implementation-loop"}}

The existing guidance_capabilities, guidance_recommend, guidance_discover, guidance_workflow, and guidance_quickref tools remain compatible. Their old string catalog is now labeled compatibility-only, and stale references are never presented as live recommendations.

The implementation loop

Generated Codex AGENTS.md guidance and capability recommendations now use one complete loop:

1. Recall relevant memory and ADR constraints.
2. Inspect source, runtime, dependencies, policy, and health.
3. Route to the smallest capable topology and tool set.
4. Plan acceptance criteria, safety, ownership, and validation.
5. Execute in isolated scopes; Ruflo coordinates while the coding agent works.
6. Test focused, regression, and failure paths.
7. Validate types, security, policy, compatibility, and artifacts.
8. Benchmark a source-bound candidate against a source-bound baseline.
9. Optimize measured bottlenecks without weakening safety.
10. Bind claims and evidence to exact source/build inputs.
11. Reconcile concurrent handoffs and disclose limitations.
12. Publish only through a separately authorized release gate.

Learning and optimization remain proposal/evidence capabilities. They cannot promote themselves or expand network, secrets, spending, concurrency, or policy authority.

Federation and Cognitum foundations

This release also adds opt-in foundations for policy-governed federation and Cognitum product actions:

• Upgraded federation peers advertise recursive JCS/Ed25519 signatures by default. JCS is negotiated only when the join includes a signature-verified peer manifest; endpoint-only joins stay untrusted.
• Legacy federation signatures are restricted to heartbeat and status-broadcast; consequential legacy messages are rejected on ingress and fail closed on egress to legacy-only peers.
• Inbound federation authorization runs after signature verification and before acceptance, replay marking, or event delivery.
• The Security SDK adds a closed 31-action product vocabulary for the Cognitum dashboard, Meta-LLM, Comms, Cog Studio, RuView, and validated learning.
• Product envelopes enforce audience, tenant, freshness, capability, policy, Ed25519 signature, action-specific obligations, and atomic replay-store hooks.
• RuView exports are constrained to registered, privacy-minimized semantic observations rather than raw sensor payloads.

Concurrent development foundations

The Codex package now exposes:

• content-addressed Git-visible source-state capture;
• separately declared and recomputable build-input/toolchain evidence;
• portable path/case ambiguity refusal;
• in-memory reference implementations for fenced leases, acknowledged inbox semantics, and content-addressed run receipts.

These references are deliberately observe-only, unsigned, non-persistent, and single-process. They help adapter authors test semantics; they are not distributed release authorities.

Install or upgrade

npm install --global ruflo@3.32.29
ruflo doctor

Or run it without a global install:

npx ruflo@3.32.29 --help

Package train:

• ruflo@3.32.29
• claude-flow@3.32.29
• @claude-flow/cli@3.32.29
• @claude-flow/codex@3.0.3
• @claude-flow/security@3.0.0-alpha.14
• @claude-flow/plugin-agent-federation@1.0.0-alpha.18

Compatibility

• Existing guidance MCP tools remain available.
• Existing projects stay in their current policy compatibility mode.
• JCS federation signing is negotiated; no downgrade occurs after a failed JCS verification.
• Older installations continue local workflows when optional packages are absent.
• The new Codex harness and Cognitum product-plane APIs are additive exports.

Local validation and benchmarks

Validated on Node.js 22/Linux:

• Capability Brain: all 353 observed live tools assigned exactly once; zero duplicate or fallback classifications.
• CLI focused brain/guardrail tests: 12 passing.
• Codex: 229 tests passing.
• Security: 559 tests passing.
• Federation: 638 tests passing.
• Capability Brain build for a 353-tool registry: p99 about 0.44 ms in the latest local run; recommendation p99 about 0.04 ms.
• 1.5 KiB federation JCS canonicalization: p50 8.39 µs, p99 8.68 µs, approximately 119,204 operations/second.
• 1.0 KiB signed Cognitum action verification: p50 71.97 µs, p99 81.93 µs, approximately 13,894 verifications/second.
• Source-state capture over a clean 200-file Git fixture averaged 15.77 ms; the dirty-patch plus 25-file manifest fixture averaged 27.09 ms.

These are local microbenchmarks, not cross-platform service SLOs.

Important limitations

These APIs are an opt-in foundation, not a declaration that distributed claim federation is production-ready. Persistent control-plane leases, durable inbox/outbox storage, signed receipt ledgers, release-decision composition, cross-service identity links, and Cognitum production adapters still require deployment-specific implementation and acceptance testing.

A lease, signature, claim, score, memory, consensus result, or passing test is evidence. None grants product or release authority by itself.

Architecture

• ADR-325: zero-trust claim federation and work ownership
• ADR-326: Cognitum product-plane federation profile
• ADR-327: federated concurrent development harness
• ADR-328: Cognitum-assisted agent learning
• ADR-329: Ruflo Capability Brain for MCP guidance

Ruflo v3.32.28: Agents That Know the Whole System

Ruflo has grown into a large agentic runtime, but its old MCP guidance catalog only knew about 61 of the 353 tools available in a fully equipped process. That made powerful features hard to discover and made agents more likely to guess at stale tool names.

v3.32.28 introduces the Ruflo Capability Brain: a live, machine-readable map of the MCP registry, CLI commands, agents, skills, packages, plugins, authority boundaries, risk, and the end-to-end implementation loop. Agents can now ask Ruflo which capabilities fit a task and automatically choose from tools that are actually registered in the current process.

What you can use it for

• Discover every MCP tool registered in your running Ruflo server.
• Route a task to suitable tools, agents, skills, and a swarm topology.
• Find capabilities across .claude, .agents, installed packages, and Ruflo plugins.
• Keep optional or remote integrations honest: registered, configured, reachable, healthy, and authorized are reported as different facts.
• Guide autonomous development through recall, inspection, planning, implementation, testing, validation, benchmarking, optimization, evidence, handoff, and authorized publication.
• Distinguish policy authorization, exclusive work claims, content-safety evidence, memory learning, consensus, and release authority.
• Route Cognitum identity through the implemented PKCE/OOB profile lifecycle, while reporting RFC 8628 polling and server-side logout revocation as unavailable instead of guessing.

Try the Capability Brain

In Codex, Claude Code, or another MCP client, ask the agent:

Use Ruflo guidance_brain to recommend the best workflow for implementing this task, then follow the returned implementation loop.

Or call the MCP tool directly:

{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement a secure API change with concurrent agents, tests, benchmarks, and a release"
  }
}

Useful modes:

{"name":"guidance_brain","arguments":{"mode":"overview"}}
{"name":"guidance_brain","arguments":{"mode":"capabilities","domain":"memory-knowledge"}}
{"name":"guidance_brain","arguments":{"mode":"coverage"}}
{"name":"guidance_brain","arguments":{"mode":"ecosystem"}}
{"name":"guidance_brain","arguments":{"mode":"implementation-loop"}}

The existing guidance_capabilities, guidance_recommend, guidance_discover, guidance_workflow, and guidance_quickref tools remain compatible. Their old string catalog is now labeled compatibility-only, and stale references are never presented as live recommendations.

The implementation loop

Generated Codex AGENTS.md guidance and capability recommendations now use one complete loop:

1. Recall relevant memory and ADR constraints.
2. Inspect source, runtime, dependencies, policy, and health.
3. Route to the smallest capable topology and tool set.
4. Plan acceptance criteria, safety, ownership, and validation.
5. Execute in isolated scopes; Ruflo coordinates while the coding agent works.
6. Test focused, regression, and failure paths.
7. Validate types, security, policy, compatibility, and artifacts.
8. Benchmark a source-bound candidate against a source-bound baseline.
9. Optimize measured bottlenecks without weakening safety.
10. Bind claims and evidence to exact source/build inputs.
11. Reconcile concurrent handoffs and disclose limitations.
12. Publish only through a separately authorized release gate.

Learning and optimization remain proposal/evidence capabilities. They cannot promote themselves or expand network, secrets, spending, concurrency, or policy authority.

Federation and Cognitum foundations

This release also adds opt-in foundations for policy-governed federation and Cognitum product actions:

• Upgraded federation peers advertise recursive JCS/Ed25519 signatures by default. JCS is negotiated only when the join includes a signature-verified peer manifest; endpoint-only joins stay untrusted.
• Legacy federation signatures are restricted to heartbeat and status-broadcast; consequential legacy messages are rejected on ingress and fail closed on egress to legacy-only peers.
• Inbound federation authorization runs after signature verification and before acceptance, replay marking, or event delivery.
• The Security SDK adds a closed 31-action product vocabulary for the Cognitum dashboard, Meta-LLM, Comms, Cog Studio, RuView, and validated learning.
• Product envelopes enforce audience, tenant, freshness, capability, policy, Ed25519 signature, action-specific obligations, and atomic replay-store hooks.
• RuView exports are constrained to registered, privacy-minimized semantic observations rather than raw sensor payloads.

Concurrent development foundations

The Codex package now exposes:

• content-addressed Git-visible source-state capture;
• separately declared and recomputable build-input/toolchain evidence;
• portable path/case ambiguity refusal;
• in-memory reference implementations for fenced leases, acknowledged inbox semantics, and content-addressed run receipts.

These references are deliberately observe-only, unsigned, non-persistent, and single-process. They help adapter authors test semantics; they are not distributed release authorities.

Install or upgrade

npm install --global ruflo@3.32.28
ruflo doctor

Or run it without a global install:

npx ruflo@3.32.28 --help

Package train:

• ruflo@3.32.28
• claude-flow@3.32.28
• @claude-flow/cli@3.32.28
• @claude-flow/codex@3.0.3
• @claude-flow/security@3.0.0-alpha.14
• @claude-flow/plugin-agent-federation@1.0.0-alpha.17

Compatibility

• Existing guidance MCP tools remain available.
• Existing projects stay in their current policy compatibility mode.
• JCS federation signing is negotiated; no downgrade occurs after a failed JCS verification.
• Older installations continue local workflows when optional packages are absent.
• The new Codex harness and Cognitum product-plane APIs are additive exports.

Local validation and benchmarks

Validated on Node.js 22/Linux:

• Capability Brain: all 353 observed live tools assigned exactly once; zero duplicate or fallback classifications.
• CLI focused brain/guardrail tests: 12 passing.
• Codex: 229 tests passing.
• Security: 559 tests passing.
• Federation: 638 tests passing.
• Capability Brain build for a 353-tool registry: p99 about 0.44 ms in the latest local run; recommendation p99 about 0.04 ms.
• 1.5 KiB federation JCS canonicalization: p50 8.47 µs, p99 8.83 µs, approximately 118,087 operations/second.
• 1.0 KiB signed Cognitum action verification: p50 71.97 µs, p99 81.93 µs, approximately 13,894 verifications/second.
• Source-state capture over a clean 200-file Git fixture averaged 15.77 ms; the dirty-patch plus 25-file manifest fixture averaged 27.09 ms.

These are local microbenchmarks, not cross-platform service SLOs.

Important limitations

These APIs are an opt-in foundation, not a declaration that distributed claim federation is production-ready. Persistent control-plane leases, durable inbox/outbox storage, signed receipt ledgers, release-decision composition, cross-service identity links, and Cognitum production adapters still require deployment-specific implementation and acceptance testing.

A lease, signature, claim, score, memory, consensus result, or passing test is evidence. None grants product or release authority by itself.

Architecture

• ADR-325: zero-trust claim federation and work ownership
• ADR-326: Cognitum product-plane federation profile
• ADR-327: federated concurrent development harness
• ADR-328: Cognitum-assisted agent learning
• ADR-329: Ruflo Capability Brain for MCP guidance

Ruflo v3.32.27 — Policy Controls for Autonomous Agents

Agents can now move quickly without receiving unlimited authority.

Ruflo v3.32.27 adds an enforceable policy layer between an agent's intent and a consequential action. Teams can define what an agent may do, cap spend and concurrency, require authenticated approval for sensitive actions, constrain delegated workers, and audit every decision through a tamper-evident receipt ledger.

Existing installations remain compatible. Start in legacy, rehearse the policy in observe, and enable blocking with enforce after reviewing the recorded decisions.

What you can use it for

• Put daily cost and token ceilings around model or tool calls.
• Require approval for production deploys, destructive actions, or flywheel promotion.
• Limit tools, MCP servers, namespaces, environments, network access, and delegated authority.
• Run bounded concurrent Codex development with a separate worktree and reduced capability envelope for every writing worker.
• Allow MetaHarness to benchmark candidates concurrently without allowing the optimizer to promote itself.
• Audit policy decisions and detect modified or reordered receipts.
• Filter AgentDB retrieval by typed provenance without breaking legacy records.

Install or upgrade

The verified GitHub release artifacts are available now. Their embedded helper manifest is signed. Install the policy runtime, CLI, and Ruflo wrapper together:

npm install --global \
  https://github.com/ruvnet/ruflo/releases/download/v3.32.27/claude-flow-security-3.0.0-alpha.13.tgz \
  https://github.com/ruvnet/ruflo/releases/download/v3.32.27/claude-flow-cli-3.32.27.tgz \
  https://github.com/ruvnet/ruflo/releases/download/v3.32.27/ruflo-3.32.27.tgz
ruflo --version
ruflo policy status

The normal npm install --global ruflo@3.32.27 path will become available after npm trusted-publisher authorization is completed. No source rebuild is required.

Safe rollout

Inspect or migrate the local policy state:

ruflo policy init
ruflo policy status
ruflo policy verify

Observe policy decisions without blocking normal actions:

ruflo policy init --mode observe

Add a daily model budget:

ruflo policy budget set '{
  "id": "daily-model-budget",
  "action": "model.call",
  "maxCostUsd": 10,
  "maxTokens": 500000,
  "periodMs": 86400000
}'

Evaluate an action:

ruflo policy evaluate '{
  "identity": {
    "id": "codex-worker-1",
    "type": "agent",
    "roles": ["developer"]
  },
  "action": {
    "type": "model.call",
    "resource": "openrouter",
    "environment": "development",
    "costUsd": 0.12,
    "tokens": 8000,
    "concurrency": 2,
    "network": true
  }
}'

After reviewing receipts and defining explicit rules:

ruflo policy init --mode enforce

The end-user quick start walks through rules, budgets, delegated capability envelopes, concurrent Codex workflows, MetaHarness promotion, and troubleshooting.

Policy-governed MetaHarness

Candidate evaluation is now bounded by both the flywheel SafetyEnvelope and the agentic policy engine:

ruflo metaharness flywheel run \
  --project-root . \
  --proposer local \
  --sample 40 \
  --max-concurrency 2 \
  --timeout-ms 120000 \
  --private-key /path/to/flywheel-private.pem \
  --public-key /path/to/flywheel-public.pem

Promotion remains a separate, explicit, policy-authorized transaction:

ruflo metaharness flywheel promote <receipt-id> \
  --project-root . \
  --public-key /path/to/flywheel-public.pem \
  --approval-id <authenticated-approval-id> \
  --confirm

Darwin proposes; Ruflo disposes. The optimizer cannot authorize its own promotion.

Safe defaults

• Existing projects migrate in backward-compatible legacy mode.
• observe records denials but does not block ordinary actions.
• Capability-envelope violations are always blocked; delegated authority cannot expand.
• observe and enforce are default-deny when no rule matches.
• Budgeted requests must report cost or token usage; missing metering does not bypass a ceiling.
• Local policy administration requires an interactive terminal.
• Approval issuance requires an authenticated human identity adapter. A local TTY is not treated as identity proof.
• MetaHarness, Darwin, and Flywheel remain optional dependencies.
• Missing optional packages do not break the local policy engine or existing AgentDB workflows.

AgentDB provenance

This release also includes ADR-323 typed provenance across AgentDB retrieval: user_claim, agent_output, system_observation, tool_result, and unknown. Legacy records remain readable and are conservatively classified as unknown; unsigned caller claims are never silently promoted to trusted evidence.

Compatibility

This is a backward-compatible patch release. Existing Ruflo and AgentDB installations continue to work without opting into enforcement. The release preserves the v3.32.26 flywheel transaction and receipt formats while adding policy authorization around privileged operations.

Release artifacts:

claude-flow-security-3.0.0-alpha.13.tgz
claude-flow-cli-3.32.27.tgz
claude-flow-3.32.27.tgz
ruflo-3.32.27.tgz
SHA256SUMS

Validation

The implementation passed:

• the complete ADR-324 policy-engine and security test suites;
• atomic budget, approval, delegation, evidence, and receipt-ledger tests;
• concurrent Codex worktree coordination tests;
• governed in-process MetaHarness evaluation and promotion tests;
• the 122-case MetaHarness contract suite;
• operation without AgentBBS or MetaHarness installed;
• MCP discoverability, install-safety, type-check, package, CodeQL, and cross-platform CI gates;
• policy-engine performance benchmarks.

Learn more

• End-user quick start
• ADR-324 architecture
• ADR-323 typed provenance
• ADR-322 governed flywheel
• Policy-engine PR #2822
• Typed-provenance PR #2820
• Full changelog

Ruflo v3.32.26 — Safer Self-Improvement

Ruflo can now test improvements to its retrieval behavior without changing the configuration you are currently using.

This release introduces a controlled flywheel:

evaluate → review → promote

Ruflo evaluates candidate settings, records the results in a verifiable receipt, and waits for you to approve an accepted candidate. Nothing is promoted automatically.

Why this matters

Self-improvement should not mean handing control to an optimizer.

With v3.32.26, you can:

• test retrieval-policy improvements against held-out tasks;
• compare quality, latency, token use, failures, and cost limits;
• inspect the evidence before making a change;
• activate an accepted candidate with an explicit command;
• audit what changed through receipts and promotion history.

Darwin can explore and propose candidates, but Ruflo remains responsible for deciding whether a candidate is safe to promote.

Install or upgrade

npm install --global ruflo@3.32.26
ruflo --version

You can also try this release without a global installation:

npx ruflo@3.32.26 metaharness flywheel status --project-root .

Try the flywheel

Check the current state:

ruflo metaharness flywheel status --project-root .

Run a local evaluation:

ruflo metaharness flywheel run \
  --project-root . \
  --proposer local \
  --sample 40 \
  --private-key /path/to/flywheel-private.pem \
  --public-key /path/to/flywheel-public.pem

Review the results:

ruflo metaharness flywheel receipts --project-root .
ruflo metaharness flywheel history --project-root .

Promote an accepted result:

ruflo metaharness flywheel promote <receipt-id> \
  --project-root . \
  --public-key /path/to/flywheel-public.pem \
  --confirm

The end-user quick start includes signing-key setup and a complete walkthrough.

Also new

• First-class metaharness flywheel commands in the CLI and MCP.
• Darwin candidate evolution through metaharness evolve.
• Stable benchmark creation and verification through metaharness bench.
• Signed receipts that detect altered evaluation evidence.
• Atomic, one-time promotion with consistent crash recovery.
• Safe local operation when the optional Darwin or Flywheel packages are not installed.

Safe by default

• Evaluation never changes the active policy.
• Promotion requires an accepted receipt and explicit --confirm.
• Stale, changed, untrusted, or already-used receipts are rejected.
• Candidate resource limits are enforced before candidates are considered.
• Darwin failures do not silently become Darwin-authorized promotions.
• Automatic unattended promotion is not enabled in this release.

v3.32.26 currently applies the new loop to bounded retrieval-policy tuning. Tool-policy evolution, model-policy evolution, and unattended autopilot remain disabled until their separate security and spending controls are ready.

Compatibility

This is a backward-compatible patch release. Existing Ruflo workflows continue to work, and the new flywheel remains opt-in.

Published packages:

ruflo@3.32.26
claude-flow@3.32.26
@claude-flow/cli@3.32.26

Validation

The release passed the focused flywheel suite, signed-receipt and tamper checks, stale-state and crash-recovery tests, resource-limit tests, and a 100-way concurrent promotion test that produced exactly one successful promotion.

Learn more

• End-user quick start
• ADR-322 architecture and safety model
• Implementation PR #2817
• Full changelog

Fixed

Floating @metaharness/darwin pin. distill-oracle.ts invoked npx --yes @metaharness/darwin with no version at three call sites (Tier-1 mechanical oracle), floating to npm latest — a breaking darwin release could change eval behavior mid-run. Now pinned via a single MH_DARWIN_PIN = '0.8.0' constant, declared @metaharness/darwin: ^0.8.0 in optionalDependencies as the single source of truth, and a stale ~0.3.1 doc comment corrected. Ruflo's analog of upstream agent-harness-generator#142.

Added

metaharness pin-drift guard (the #149 analog ruflo lacked):

• scripts/check-metaharness-pins.mjs — diffs each declared range (metaharness, @metaharness/router, @metaharness/darwin) against npm latest + a lock-step check that MH_DARWIN_PIN satisfies the darwin range. Network flakes warn, never false-positive.
• .github/workflows/metaharness-pin-drift.yml — runs weekly + on PRs touching the pins; opens/updates a tracking issue on drift, hard-fails PRs that introduce it.

Upstream companion PRs

Filed against the metaharness repo: #150 (darwin pin ^0.2.2→^0.8.0, #142) and #151 (META_PROXY_VERSION→0.7.0 + ported pin-drift watcher, #149).

Upgrade

npx ruflo@latest --version   # → 3.32.25

Refs: ADR-150, ADR-321.

Fixed

#2801 — ruflo init --codex/--dual now installs the ruflo-core@ruflo plugin. Before, Codex init set up AGENTS.md, skills, config, and the Ruflo MCP server — but no Ruflo lifecycle hooks. New installRufloCorePlugin() idempotently runs codex plugin marketplace add ruvnet/ruflo --ref main + codex plugin add ruflo-core@ruflo at user scope (canonical upstream plugin, avoiding the #2640 double-firing class), degrades gracefully with a manual-install hint if the Codex CLI is absent, and always emits a prominent ACTION REQUIRED message to trust the hooks in a new Codex session (Codex does not auto-trust command hooks). Ships in @claude-flow/codex@3.0.2.

Changed

metaharness promoted to a hard dependency (ADR-321). metaharness@^0.4.1 and @metaharness/router@^0.3.2 moved from optional to dependencies on @claude-flow/cli, so they're always present. ADR-321 supersedes ADR-150's optional-only constraint for these two and records the tradeoff honestly: the MCP metaharness tools invoke via subprocess (zero static imports), so this is functionally a cache-warm for them; the one load-bearing consumer of a declared dep is neural-router.ts's @metaharness/router import behind CLAUDE_FLOW_ROUTER_NEURAL=1. Graceful-degradation fallbacks were kept (trivial reversibility).

Packages

Package	Version
@claude-flow/cli / claude-flow / ruflo	3.32.24
@claude-flow/codex	3.0.2

Upgrade

npx ruflo@latest --version   # → 3.32.24

Closes: #2801. Refs: ADR-321, ADR-150.

Three "clean exit, no real work reflected" bugs reported by @vidaunited on v3.32.22 — all reader/writer store-shape mismatches. Each fixed and validated E2E on the published package.

Fixed

#2797 — hooks metrics Pattern Learning always 0. The pattern reader filtered on key.includes('pattern') || metadata.type==='pattern' || key.startsWith('learned-'), but no writer produces that shape. The post-task dual-write (#2786 fix-2) persists learned patterns as routing-decision:* entries in the patterns namespace. Fix: broaden the pattern filter to count namespace==='patterns' and metadata.type==='routing-decision'. Shipped validation: patterns.total 0 → 1 after one hooks post-task --store-results.

#2798 — Nightly memory backup silent no-op under CLAUDE_FLOW_ENCRYPT_AT_REST. Same class as #2786: backupMemoryDb() opened the RFE1-encrypted .swarm/memory.db with better-sqlite3's online-backup API → "file is not a database" → recorded as skipped while the worker reported 100% success. Users with encryption had zero backups behind a green status. Fix: fall back to a plain byte copy (valid — sql.js rewrites the encrypted file wholesale per flush). Shipped validation: RFE1 source → 176 KB snapshot written.

#2799 — swarm status always Total 0 agents. swarm status read .swarm/agents/*.json (never written); agent spawn records the count in .claude-flow/metrics/swarm-activity.json. Fix: reconcile against the activity file agent spawn actually writes when the agents dir is empty. Shipped validation: spawn 4 → swarm status Total 0 → 4 (matches agent list).

Verification

• Regression tests: 3/3 pass (hooks-metrics-swarm-backup-2797-2798-2799.test.ts, real execFileSync repros)
• Post-publish: all three fixes re-validated on npx ruflo@3.32.23

Upgrade

npx ruflo@latest --version   # → 3.32.23

Closes: #2797 #2798 #2799.

Hotfix for the verification agent's #2794 finding — CI on main was red since 03:04 UTC because v3.32.17's #2752 MemPoison env var didn't match the ADR-125 §"CLI flag wins" pattern the audit script requires.

Fixed

Restructured the RUFLO_MEMORY_SCAN_ON_WRITE read so ctx.flags.scanContent takes precedence via nullish coalescing, with the exact ADR-125 comment format. Removed default: false from the --scan-content option so the parser leaves it undefined when unset (required for ?? env to see the env value). Explicit --no-scan-content still wins over the env var.

Verification

• Audit script: ok: all CLAUDE_FLOW_ / RUFLO_ env var reads have documented CLI-flag precedence**
• Regression tests still green: planflip-mempoison-2752 (6/6) + memory-search-2790 (4/4)

Closes: #2794.

Two-defect fix filed by markt-heximal in #2790.

Fixed

--type keyword|hybrid silently ignored. memory search accepted, echoed, and then discarded the type flag — every search ran semantic. Now:

• --type keyword — listEntries + substring match on key+content, key hit scores 1.0, content hit 0.7
• --type hybrid — semantic ∪ keyword, dedup by (namespace, key), rerank

--threshold 0 silently replaced by fallback. Classic 0 || fallback idiom. Fixed with nullish coalescing at 3 reporter-flagged sites (memory.ts, embeddings.ts twice) plus 4 same-class hooks.ts sites (per reporter's "worth grepping more broadly" note). Also reconciled the memory.ts declared-default (0.7) vs code-fallback (0.3) disagreement.

Reporter's diagnostic invariant now holds: lower threshold returns ≥ results, not fewer.

Regression tests

4/4 E2E via real execFileSync against bin/cli.js:

• --type keyword hits substring
• --type keyword returns 0 for absent substring
• --type hybrid ≥ semantic set
• --threshold 0 ≥ --threshold 0.01 (monotonic)

Upgrade

npx ruflo@latest --version   # → 3.32.21

Closes: #2790.