# ruflo changelog

> ruflo release notes.

- Vendor: ruflo
- Category: AI
- Official site: https://cognitum.one/
- Tracked by: What's New (https://whatsnew.fyi/product/ruflo)
- Harvested from: GitHub (ruvnet/ruflo)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v3.32.30 — Ruflo v3.32.30 — Capability Brain and self-contained policy runtime

- Date: 2026-07-29
- Version: v3.32.30
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.30
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.30

#### Ruflo v3.32.30: Capability Brain, Now Complete in the Public Install

Ruflo can coordinate hundreds of agent, memory, policy, federation, and
MetaHarness capabilities—but users should not have to memorize that surface or
install unpublished internal packages to make it work. v3.32.30 makes the
public install self-contained and teaches newly initialized agents how to use
the system safely.

This is a corrective release for v3.32.29. That package exposed the new policy
runtime through a static `@claude-flow/security` import while declaring the
unpublished package optional. Fresh installs could run `--version`, but policy
and daemon command loading failed with `ERR_MODULE_NOT_FOUND`. v3.32.30 embeds
the reviewed Security, Codex, and federation runtimes in each applicable public
artifact and promotes their public transitive dependencies to the containing
package.

##### What this enables

- Ask `guidance_brain` which registered Ruflo capabilities fit a task instead
  of guessing tool names.
- Run the full policy ledger, daemon, MCP, and standard CLI command surface
  from a fresh three-package installation.
- Generate `CLAUDE.md` and `AGENTS.md` instructions that use the Capability
  Brain, the validated implementation loop, isolated concurrent writers,
  source-bound evidence, and non-expanding authority envelopes.
- Initialize Codex projects from the bundled adapter, including its built-in
  skills, without requiring a standalone `@claude-flow/codex` publication.
- Discover the bundled federation foundation without requiring a standalone
  federation package. Production federation still requires deployment-specific
  durable storage, identity, policy, and acceptance testing.

##### Install or upgrade

```bash
npm install --global ruflo@3.32.30
ruflo doctor
```

Or run without a global install:

```bash
npx ruflo@3.32.30 --help
```

##### Use the Capability Brain

From an MCP client:

```json
{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement, test, benchmark, and review this change with concurrent agents"
  }
}
```

The returned workflow follows:

```text
recall → inspect → route → plan → execute → test → validate
       → benchmark → optimize → receipt → handoff → authorized publish
```

Learning, Darwin, Flywheel, and MetaHarness can propose or evaluate candidates.
They cannot promote themselves or expand tools, network access, secrets,
spending, concurrency, or release authority.

##### Concurrent development defaults

Generated guidance now requires:

- one isolated worktree and explicit file scope per writing agent;
- shared checkouts only for read-only research;
- one integration owner for shared manifests, lockfiles, and overlap
  reconciliation;
- continued independent work after spawning agents rather than stopping;
- tests, benchmarks, policy decisions, and handoffs bound to an exact clean
  commit or immutable dirty-worktree snapshot.

##### Public package train

The normal release publishes exactly:

- `@claude-flow/cli@3.32.30`
- `claude-flow@3.32.30`
- `ruflo@3.32.30`

The Security, Codex, and federation runtimes are built from the reviewed
monorepo source and carried as npm bundled dependencies inside the CLI and
umbrella artifacts. Their source package coordinates are not published as part
of this release.

##### Compatibility

- Existing projects are never overwritten by `init` unless `--force` is used.
- Existing guidance MCP tools remain available when `guidance_brain` is absent.
- Policy migration remains `legacy` by default; operators can move through
  `observe` before `enforce`.
- Optional native keychain, AgentDB, neural, and MetaHarness dependencies retain
  their existing graceful-degradation behavior.
- `ruflo`, `claude-flow`, and `@claude-flow/cli` remain version-locked and
  install through their established command names.

##### Validation contract

Release acceptance requires:

- the three-package version lockstep audit;
- focused generated-guidance

_[Truncated at 4000 characters — full notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.30]_

### v3.32.29 — Ruflo v3.32.29: Capability Brain — Corrected Stable Train

- Date: 2026-07-29
- Version: v3.32.29
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.29
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.29

#### Ruflo v3.32.29: Capability Brain — Corrected Stable Train

v3.32.29 is the corrective stable publication of the Capability Brain work
first preserved in the immutable
[v3.32.28 source release](https://github.com/ruvnet/ruflo/releases/tag/v3.32.28).
The v3.32.28 npm train was not published: its release credential was rejected,
and the intended federation `1.0.0-alpha.17` coordinate was already occupied by
an older artifact. Ruflo did not move the existing tag or reuse the immutable
package coordinate.

This release advances `ruflo`, `claude-flow`, and `@claude-flow/cli` to
`3.32.29`, advances the federation plugin to `1.0.0-alpha.18`, and retains the
reviewed `@claude-flow/security@3.0.0-alpha.14` and
`@claude-flow/codex@3.0.3` components. The original release and its end-user
gist remain intact. The corrected end-user guide is available as a
[separate v3.32.29 gist](https://gist.github.com/ruvnet/934130093d333bde1a3f0f83d7d95115).

Ruflo has grown into a large agentic runtime, but its old MCP guidance catalog
only knew about 61 of the 353 tools available in a fully equipped process. That
made powerful features hard to discover and made agents more likely to guess
at stale tool names.

v3.32.29 publishes the Ruflo Capability Brain: a live, machine-readable map of
the MCP registry, CLI commands, agents, skills, packages, plugins, authority
boundaries, risk, and the end-to-end implementation loop. Agents can now ask
Ruflo which capabilities fit a task and automatically choose from tools that
are actually registered in the current process.

##### What you can use it for

- Discover every MCP tool registered in your running Ruflo server.
- Route a task to suitable tools, agents, skills, and a swarm topology.
- Find capabilities across `.claude`, `.agents`, installed packages, and Ruflo
  plugins.
- Keep optional or remote integrations honest: registered, configured,
  reachable, healthy, and authorized are reported as different facts.
- Guide autonomous development through recall, inspection, planning,
  implementation, testing, validation, benchmarking, optimization, evidence,
  handoff, and authorized publication.
- Distinguish policy authorization, exclusive work claims, content-safety
  evidence, memory learning, consensus, and release authority.
- Route Cognitum identity through the implemented PKCE/OOB profile lifecycle,
  while reporting RFC 8628 polling and server-side logout revocation as
  unavailable instead of guessing.

##### Try the Capability Brain

In Codex, Claude Code, or another MCP client, ask the agent:

> Use Ruflo `guidance_brain` to recommend the best workflow for implementing
> this task, then follow the returned implementation loop.

Or call the MCP tool directly:

```json
{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement a secure API change with concurrent agents, tests, benchmarks, and a release"
  }
}
```

Useful modes:

```json
{"name":"guidance_brain","arguments":{"mode":"overview"}}
{"name":"guidance_brain","arguments":{"mode":"capabilities","domain":"memory-knowledge"}}
{"name":"guidance_brain","arguments":{"mode":"coverage"}}
{"name":"guidance_brain","arguments":{"mode":"ecosystem"}}
{"name":"guidance_brain","arguments":{"mode":"implementation-loop"}}
```

The existing `guidance_capabilities`, `guidance_recommend`,
`guidance_discover`, `guidance_workflow`, and `guidance_quickref` tools remain
compatible. Their old string catalog is now labeled compatibility-only, and
stale references are never presented as live recommendations.

##### The implementation loop

Generated Codex `AGENTS.md` guidance and capability recommendations now use one
complete loop:

1. Recall relevant memory and ADR constraints.
2. Inspect source, runtime, dependencies, policy, and health.
3. Route to the smallest capable topology and tool set.
4. Plan acceptance criteria, safety, ownership, and validation.
5. Execute in isolated scopes; Ruflo coordinates while the coding agent

_[Truncated at 4000 characters — full notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.29]_

### v3.32.28 — Ruflo v3.32.28 — Agents That Know the Whole System

- Date: 2026-07-29
- Version: v3.32.28
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.28
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.28

#### Ruflo v3.32.28: Agents That Know the Whole System

Ruflo has grown into a large agentic runtime, but its old MCP guidance catalog
only knew about 61 of the 353 tools available in a fully equipped process. That
made powerful features hard to discover and made agents more likely to guess
at stale tool names.

v3.32.28 introduces the Ruflo Capability Brain: a live, machine-readable map of
the MCP registry, CLI commands, agents, skills, packages, plugins, authority
boundaries, risk, and the end-to-end implementation loop. Agents can now ask
Ruflo which capabilities fit a task and automatically choose from tools that
are actually registered in the current process.

##### What you can use it for

- Discover every MCP tool registered in your running Ruflo server.
- Route a task to suitable tools, agents, skills, and a swarm topology.
- Find capabilities across `.claude`, `.agents`, installed packages, and Ruflo
  plugins.
- Keep optional or remote integrations honest: registered, configured,
  reachable, healthy, and authorized are reported as different facts.
- Guide autonomous development through recall, inspection, planning,
  implementation, testing, validation, benchmarking, optimization, evidence,
  handoff, and authorized publication.
- Distinguish policy authorization, exclusive work claims, content-safety
  evidence, memory learning, consensus, and release authority.
- Route Cognitum identity through the implemented PKCE/OOB profile lifecycle,
  while reporting RFC 8628 polling and server-side logout revocation as
  unavailable instead of guessing.

##### Try the Capability Brain

In Codex, Claude Code, or another MCP client, ask the agent:

> Use Ruflo `guidance_brain` to recommend the best workflow for implementing
> this task, then follow the returned implementation loop.

Or call the MCP tool directly:

```json
{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement a secure API change with concurrent agents, tests, benchmarks, and a release"
  }
}
```

Useful modes:

```json
{"name":"guidance_brain","arguments":{"mode":"overview"}}
{"name":"guidance_brain","arguments":{"mode":"capabilities","domain":"memory-knowledge"}}
{"name":"guidance_brain","arguments":{"mode":"coverage"}}
{"name":"guidance_brain","arguments":{"mode":"ecosystem"}}
{"name":"guidance_brain","arguments":{"mode":"implementation-loop"}}
```

The existing `guidance_capabilities`, `guidance_recommend`,
`guidance_discover`, `guidance_workflow`, and `guidance_quickref` tools remain
compatible. Their old string catalog is now labeled compatibility-only, and
stale references are never presented as live recommendations.

##### The implementation loop

Generated Codex `AGENTS.md` guidance and capability recommendations now use one
complete loop:

1. Recall relevant memory and ADR constraints.
2. Inspect source, runtime, dependencies, policy, and health.
3. Route to the smallest capable topology and tool set.
4. Plan acceptance criteria, safety, ownership, and validation.
5. Execute in isolated scopes; Ruflo coordinates while the coding agent works.
6. Test focused, regression, and failure paths.
7. Validate types, security, policy, compatibility, and artifacts.
8. Benchmark a source-bound candidate against a source-bound baseline.
9. Optimize measured bottlenecks without weakening safety.
10. Bind claims and evidence to exact source/build inputs.
11. Reconcile concurrent handoffs and disclose limitations.
12. Publish only through a separately authorized release gate.

Learning and optimization remain proposal/evidence capabilities. They cannot
promote themselves or expand network, secrets, spending, concurrency, or
policy authority.

##### Federation and Cognitum foundations

This release also adds opt-in foundations for policy-governed federation and
Cognitum product actions:

- Upgraded federation peers advertise recursive JCS/Ed25519 signatures by
  default. JCS is negotiated only when the join includes a signature-

_[Truncated at 4000 characters — full notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.28]_

### v3.32.27 — Ruflo v3.32.27 — Policy Controls for Autonomous Agents

- Date: 2026-07-29
- Version: v3.32.27
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.27
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.27

<!-- markdownlint-disable MD013 -->

#### Ruflo v3.32.27 — Policy Controls for Autonomous Agents

Agents can now move quickly without receiving unlimited authority.

Ruflo v3.32.27 adds an enforceable policy layer between an agent's intent and a
consequential action. Teams can define what an agent may do, cap spend and
concurrency, require authenticated approval for sensitive actions, constrain
delegated workers, and audit every decision through a tamper-evident receipt
ledger.

Existing installations remain compatible. Start in `legacy`, rehearse the
policy in `observe`, and enable blocking with `enforce` after reviewing the
recorded decisions.

##### What you can use it for

- Put daily cost and token ceilings around model or tool calls.
- Require approval for production deploys, destructive actions, or flywheel
  promotion.
- Limit tools, MCP servers, namespaces, environments, network access, and
  delegated authority.
- Run bounded concurrent Codex development with a separate worktree and reduced
  capability envelope for every writing worker.
- Allow MetaHarness to benchmark candidates concurrently without allowing the
  optimizer to promote itself.
- Audit policy decisions and detect modified or reordered receipts.
- Filter AgentDB retrieval by typed provenance without breaking legacy records.

##### Install or upgrade

The verified GitHub release artifacts are available now. Their embedded helper
manifest is signed. Install the policy runtime, CLI, and Ruflo wrapper together:

```bash
npm install --global \
  https://github.com/ruvnet/ruflo/releases/download/v3.32.27/claude-flow-security-3.0.0-alpha.13.tgz \
  https://github.com/ruvnet/ruflo/releases/download/v3.32.27/claude-flow-cli-3.32.27.tgz \
  https://github.com/ruvnet/ruflo/releases/download/v3.32.27/ruflo-3.32.27.tgz
ruflo --version
ruflo policy status
```

The normal `npm install --global ruflo@3.32.27` path will become available
after npm trusted-publisher authorization is completed. No source rebuild is
required.

##### Safe rollout

Inspect or migrate the local policy state:

```bash
ruflo policy init
ruflo policy status
ruflo policy verify
```

Observe policy decisions without blocking normal actions:

```bash
ruflo policy init --mode observe
```

Add a daily model budget:

```bash
ruflo policy budget set '{
  "id": "daily-model-budget",
  "action": "model.call",
  "maxCostUsd": 10,
  "maxTokens": 500000,
  "periodMs": 86400000
}'
```

Evaluate an action:

```bash
ruflo policy evaluate '{
  "identity": {
    "id": "codex-worker-1",
    "type": "agent",
    "roles": ["developer"]
  },
  "action": {
    "type": "model.call",
    "resource": "openrouter",
    "environment": "development",
    "costUsd": 0.12,
    "tokens": 8000,
    "concurrency": 2,
    "network": true
  }
}'
```

After reviewing receipts and defining explicit rules:

```bash
ruflo policy init --mode enforce
```

The [end-user quick start](https://gist.github.com/ruvnet/19ef247dbc7d0b3507f5dfbd5cbb0e87) walks through rules, budgets, delegated
capability envelopes, concurrent Codex workflows, MetaHarness promotion, and
troubleshooting.

##### Policy-governed MetaHarness

Candidate evaluation is now bounded by both the flywheel SafetyEnvelope and the
agentic policy engine:

```bash
ruflo metaharness flywheel run \
  --project-root . \
  --proposer local \
  --sample 40 \
  --max-concurrency 2 \
  --timeout-ms 120000 \
  --private-key /path/to/flywheel-private.pem \
  --public-key /path/to/flywheel-public.pem
```

Promotion remains a separate, explicit, policy-authorized transaction:

```bash
ruflo metaharness flywheel promote <receipt-id> \
  --project-root . \
  --public-key /path/to/flywheel-public.pem \
  --approval-id <authenticated-approval-id> \
  --confirm
```

Darwin proposes; Ruflo disposes. The optimizer cannot authorize its own
promotion.

##### Safe defaults

- Existing projects migrate in backward-compatible `legacy` mode.
- `observe` records denials but does not block ordinary act

_[Truncated at 4000 characters — full notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.27]_

### v3.32.26 — Ruflo v3.32.26 — Safer Self-Improvement

- Date: 2026-07-28
- Version: v3.32.26
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.26
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.26

<!-- markdownlint-disable MD013 -->

#### Ruflo v3.32.26 — Safer Self-Improvement

Ruflo can now test improvements to its retrieval behavior without changing the configuration you are currently using.

This release introduces a controlled flywheel:

```text
evaluate → review → promote
```

Ruflo evaluates candidate settings, records the results in a verifiable receipt, and waits for you to approve an accepted candidate. Nothing is promoted automatically.

##### Why this matters

Self-improvement should not mean handing control to an optimizer.

With v3.32.26, you can:

- test retrieval-policy improvements against held-out tasks;
- compare quality, latency, token use, failures, and cost limits;
- inspect the evidence before making a change;
- activate an accepted candidate with an explicit command;
- audit what changed through receipts and promotion history.

Darwin can explore and propose candidates, but Ruflo remains responsible for deciding whether a candidate is safe to promote.

##### Install or upgrade

```bash
npm install --global ruflo@3.32.26
ruflo --version
```

You can also try this release without a global installation:

```bash
npx ruflo@3.32.26 metaharness flywheel status --project-root .
```

##### Try the flywheel

Check the current state:

```bash
ruflo metaharness flywheel status --project-root .
```

Run a local evaluation:

```bash
ruflo metaharness flywheel run \
  --project-root . \
  --proposer local \
  --sample 40 \
  --private-key /path/to/flywheel-private.pem \
  --public-key /path/to/flywheel-public.pem
```

Review the results:

```bash
ruflo metaharness flywheel receipts --project-root .
ruflo metaharness flywheel history --project-root .
```

Promote an accepted result:

```bash
ruflo metaharness flywheel promote <receipt-id> \
  --project-root . \
  --public-key /path/to/flywheel-public.pem \
  --confirm
```

The [end-user quick start](https://gist.github.com/ruvnet/ed0b740580ae86a26fd41b1c98ed4391) includes signing-key setup and a complete walkthrough.

##### Also new

- First-class `metaharness flywheel` commands in the CLI and MCP.
- Darwin candidate evolution through `metaharness evolve`.
- Stable benchmark creation and verification through `metaharness bench`.
- Signed receipts that detect altered evaluation evidence.
- Atomic, one-time promotion with consistent crash recovery.
- Safe local operation when the optional Darwin or Flywheel packages are not installed.

##### Safe by default

- Evaluation never changes the active policy.
- Promotion requires an accepted receipt and explicit `--confirm`.
- Stale, changed, untrusted, or already-used receipts are rejected.
- Candidate resource limits are enforced before candidates are considered.
- Darwin failures do not silently become Darwin-authorized promotions.
- Automatic unattended promotion is not enabled in this release.

v3.32.26 currently applies the new loop to bounded retrieval-policy tuning. Tool-policy evolution, model-policy evolution, and unattended autopilot remain disabled until their separate security and spending controls are ready.

##### Compatibility

This is a backward-compatible patch release. Existing Ruflo workflows continue to work, and the new flywheel remains opt-in.

Published packages:

```text
ruflo@3.32.26
claude-flow@3.32.26
@claude-flow/cli@3.32.26
```

##### Validation

The release passed the focused flywheel suite, signed-receipt and tamper checks, stale-state and crash-recovery tests, resource-limit tests, and a 100-way concurrent promotion test that produced exactly one successful promotion.

##### Learn more

- [End-user quick start](https://gist.github.com/ruvnet/ed0b740580ae86a26fd41b1c98ed4391)
- [ADR-322 architecture and safety model](https://github.com/ruvnet/ruflo/blob/v3.32.26/v3/docs/adr/ADR-322-metaharness-flywheel-integration.md)
- [Implementation PR #2817](https://github.com/ruvnet/ruflo/pull/2817)
- [Full changelog](https://github.com/ruvnet/ruflo/compare/v3.32.25...v3.32.26)

### v3.32.25 — v3.32.25 — metaharness pin-drift guard

- Date: 2026-07-28
- Version: v3.32.25
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.25
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.25

##### Fixed

**Floating `@metaharness/darwin` pin.** `distill-oracle.ts` invoked `npx --yes @metaharness/darwin` with no version at three call sites (Tier-1 mechanical oracle), floating to npm `latest` — a breaking darwin release could change eval behavior mid-run. Now pinned via a single `MH_DARWIN_PIN = '0.8.0'` constant, declared `@metaharness/darwin: ^0.8.0` in optionalDependencies as the single source of truth, and a stale `~0.3.1` doc comment corrected. Ruflo's analog of upstream [agent-harness-generator#142](https://github.com/ruvnet/agent-harness-generator/issues/142).

##### Added

**metaharness pin-drift guard** (the [#149](https://github.com/ruvnet/agent-harness-generator/issues/149) analog ruflo lacked):
- `scripts/check-metaharness-pins.mjs` — diffs each declared range (`metaharness`, `@metaharness/router`, `@metaharness/darwin`) against npm `latest` + a lock-step check that `MH_DARWIN_PIN` satisfies the darwin range. Network flakes warn, never false-positive.
- `.github/workflows/metaharness-pin-drift.yml` — runs weekly + on PRs touching the pins; opens/updates a tracking issue on drift, hard-fails PRs that introduce it.

##### Upstream companion PRs

Filed against the metaharness repo: [#150](https://github.com/ruvnet/metaharness/pull/150) (darwin pin ^0.2.2→^0.8.0, #142) and [#151](https://github.com/ruvnet/metaharness/pull/151) (META_PROXY_VERSION→0.7.0 + ported pin-drift watcher, #149).

##### Upgrade

```bash
npx ruflo@latest --version   # → 3.32.25
```

Refs: ADR-150, ADR-321.

### v3.32.24 — v3.32.24 — Codex plugin install (#2801) + metaharness hard dependency (ADR-321)

- Date: 2026-07-28
- Version: v3.32.24
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.24
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.24

##### Fixed

**#2801 — `ruflo init --codex/--dual` now installs the `ruflo-core@ruflo` plugin.** Before, Codex init set up AGENTS.md, skills, config, and the Ruflo MCP server — but no Ruflo lifecycle hooks. New `installRufloCorePlugin()` idempotently runs `codex plugin marketplace add ruvnet/ruflo --ref main` + `codex plugin add ruflo-core@ruflo` at user scope (canonical upstream plugin, avoiding the #2640 double-firing class), degrades gracefully with a manual-install hint if the Codex CLI is absent, and always emits a prominent **ACTION REQUIRED** message to trust the hooks in a new Codex session (Codex does not auto-trust command hooks). Ships in `@claude-flow/codex@3.0.2`.

##### Changed

**metaharness promoted to a hard dependency (ADR-321).** `metaharness@^0.4.1` and `@metaharness/router@^0.3.2` moved from optional to `dependencies` on `@claude-flow/cli`, so they're always present. ADR-321 supersedes ADR-150's optional-only constraint for these two and records the tradeoff honestly: the MCP metaharness tools invoke via subprocess (zero static imports), so this is functionally a cache-warm for them; the one load-bearing consumer of a declared dep is `neural-router.ts`'s `@metaharness/router` import behind `CLAUDE_FLOW_ROUTER_NEURAL=1`. Graceful-degradation fallbacks were kept (trivial reversibility).

##### Packages

| Package | Version |
|---|---|
| `@claude-flow/cli` / `claude-flow` / `ruflo` | 3.32.24 |
| `@claude-flow/codex` | 3.0.2 |

##### Upgrade

```bash
npx ruflo@latest --version   # → 3.32.24
```

Closes: #2801. Refs: ADR-321, ADR-150.

### v3.32.23 — v3.32.23 — reader/writer store fixes: metrics, backup, swarm status (#2797 #2798 #2799)

- Date: 2026-07-28
- Version: v3.32.23
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.23
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.23

Three "clean exit, no real work reflected" bugs reported by @vidaunited on v3.32.22 — all reader/writer store-shape mismatches. Each fixed and validated E2E on the published package.

##### Fixed

**#2797 — `hooks metrics` Pattern Learning always 0.** The pattern reader filtered on `key.includes('pattern') || metadata.type==='pattern' || key.startsWith('learned-')`, but no writer produces that shape. The post-task dual-write (#2786 fix-2) persists learned patterns as `routing-decision:*` entries in the `patterns` namespace. Fix: broaden the pattern filter to count `namespace==='patterns'` and `metadata.type==='routing-decision'`. **Shipped validation:** `patterns.total` 0 → 1 after one `hooks post-task --store-results`.

**#2798 — Nightly memory backup silent no-op under `CLAUDE_FLOW_ENCRYPT_AT_REST`.** Same class as #2786: `backupMemoryDb()` opened the RFE1-encrypted `.swarm/memory.db` with better-sqlite3's online-backup API → "file is not a database" → recorded as skipped while the worker reported 100% success. Users with encryption had zero backups behind a green status. Fix: fall back to a plain byte copy (valid — sql.js rewrites the encrypted file wholesale per flush). **Shipped validation:** RFE1 source → 176 KB snapshot written.

**#2799 — `swarm status` always Total 0 agents.** `swarm status` read `.swarm/agents/*.json` (never written); `agent spawn` records the count in `.claude-flow/metrics/swarm-activity.json`. Fix: reconcile against the activity file `agent spawn` actually writes when the agents dir is empty. **Shipped validation:** spawn 4 → swarm status Total 0 → 4 (matches `agent list`).

##### Verification

- Regression tests: **3/3** pass (`hooks-metrics-swarm-backup-2797-2798-2799.test.ts`, real execFileSync repros)
- Post-publish: all three fixes re-validated on `npx ruflo@3.32.23`

##### Upgrade

```bash
npx ruflo@latest --version   # → 3.32.23
```

Closes: #2797 #2798 #2799.

### v3.32.22 — v3.32.22 — CI-green hotfix: ADR-125 CLI-flag precedence for RUFLO_MEMORY_SCAN_ON_WRITE (#2794)

- Date: 2026-07-27
- Version: v3.32.22
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.22
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.22

Hotfix for the verification agent's #2794 finding — CI on main was red since 03:04 UTC because v3.32.17's #2752 MemPoison env var didn't match the ADR-125 §"CLI flag wins" pattern the audit script requires.

##### Fixed

Restructured the `RUFLO_MEMORY_SCAN_ON_WRITE` read so `ctx.flags.scanContent` takes precedence via nullish coalescing, with the exact ADR-125 comment format. Removed `default: false` from the `--scan-content` option so the parser leaves it `undefined` when unset (required for `?? env` to see the env value). Explicit `--no-scan-content` still wins over the env var.

##### Verification

- Audit script: **ok: all CLAUDE_FLOW_* / RUFLO_* env var reads have documented CLI-flag precedence**
- Regression tests still green: planflip-mempoison-2752 (6/6) + memory-search-2790 (4/4)

Closes: #2794.

### v3.32.21 — v3.32.21 — fix(memory/embeddings): --type keyword|hybrid + --threshold 0 (#2790)

- Date: 2026-07-27
- Version: v3.32.21
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.32.21
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.32.21

Two-defect fix filed by markt-heximal in #2790.

##### Fixed

**--type keyword|hybrid silently ignored**. `memory search` accepted, echoed, and then discarded the type flag — every search ran semantic. Now:
- `--type keyword` — listEntries + substring match on key+content, key hit scores 1.0, content hit 0.7
- `--type hybrid` — semantic ∪ keyword, dedup by (namespace, key), rerank

**--threshold 0 silently replaced by fallback**. Classic `0 || fallback` idiom. Fixed with nullish coalescing at 3 reporter-flagged sites (memory.ts, embeddings.ts twice) plus 4 same-class hooks.ts sites (per reporter's "worth grepping more broadly" note). Also reconciled the memory.ts declared-default (0.7) vs code-fallback (0.3) disagreement.

Reporter's diagnostic invariant now holds: **lower threshold returns ≥ results**, not fewer.

##### Regression tests

**4/4** E2E via real execFileSync against bin/cli.js:
- --type keyword hits substring
- --type keyword returns 0 for absent substring
- --type hybrid ≥ semantic set
- --threshold 0 ≥ --threshold 0.01 (monotonic)

##### Upgrade

```bash
npx ruflo@latest --version   # → 3.32.21
```

Closes: #2790.