ruflo v3.32.30

Ruflo v3.32.30: Capability Brain, Now Complete in the Public Install

Ruflo can coordinate hundreds of agent, memory, policy, federation, and MetaHarness capabilities—but users should not have to memorize that surface or install unpublished internal packages to make it work. v3.32.30 makes the public install self-contained and teaches newly initialized agents how to use the system safely.

This is a corrective release for v3.32.29. That package exposed the new policy runtime through a static @claude-flow/security import while declaring the unpublished package optional. Fresh installs could run --version, but policy and daemon command loading failed with ERR_MODULE_NOT_FOUND. v3.32.30 embeds the reviewed Security, Codex, and federation runtimes in each applicable public artifact and promotes their public transitive dependencies to the containing package.

What this enables

• Ask guidance_brain which registered Ruflo capabilities fit a task instead of guessing tool names.
• Run the full policy ledger, daemon, MCP, and standard CLI command surface from a fresh three-package installation.
• Generate CLAUDE.md and AGENTS.md instructions that use the Capability Brain, the validated implementation loop, isolated concurrent writers, source-bound evidence, and non-expanding authority envelopes.
• Initialize Codex projects from the bundled adapter, including its built-in skills, without requiring a standalone @claude-flow/codex publication.
• Discover the bundled federation foundation without requiring a standalone federation package. Production federation still requires deployment-specific durable storage, identity, policy, and acceptance testing.

Install or upgrade

npm install --global ruflo@3.32.30
ruflo doctor

Or run without a global install:

npx ruflo@3.32.30 --help

Use the Capability Brain

From an MCP client:

{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement, test, benchmark, and review this change with concurrent agents"
  }
}

The returned workflow follows:

recall → inspect → route → plan → execute → test → validate
       → benchmark → optimize → receipt → handoff → authorized publish

Learning, Darwin, Flywheel, and MetaHarness can propose or evaluate candidates. They cannot promote themselves or expand tools, network access, secrets, spending, concurrency, or release authority.

Concurrent development defaults

Generated guidance now requires:

• one isolated worktree and explicit file scope per writing agent;
• shared checkouts only for read-only research;
• one integration owner for shared manifests, lockfiles, and overlap reconciliation;
• continued independent work after spawning agents rather than stopping;
• tests, benchmarks, policy decisions, and handoffs bound to an exact clean commit or immutable dirty-worktree snapshot.

Public package train

The normal release publishes exactly:

• @claude-flow/cli@3.32.30
• claude-flow@3.32.30
• ruflo@3.32.30

The Security, Codex, and federation runtimes are built from the reviewed monorepo source and carried as npm bundled dependencies inside the CLI and umbrella artifacts. Their source package coordinates are not published as part of this release.

Compatibility

• Existing projects are never overwritten by init unless --force is used.
• Existing guidance MCP tools remain available when guidance_brain is absent.
• Policy migration remains legacy by default; operators can move through observe before enforce.
• Optional native keychain, AgentDB, neural, and MetaHarness dependencies retain their existing graceful-degradation behavior.
• ruflo, claude-flow, and @claude-flow/cli remain version-locked and install through their established command names.

Validation contract

Release acceptance requires:

• the three-package version lockstep audit;
• focused generated-guidance and Codex adapter tests;
• Security, Codex, and federation builds and tests;
• tarball inspection proving all three internal runtimes are bundled;
• fresh tarball installation with optional dependencies omitted;
• --version, policy status, daemon start/status/stop, and init --codex smoke tests;
• npm ls without invalid dependency edges;
• registry verification and aligned latest, alpha, and v3alpha tags.