ruflo updates — week of 2026-05-17 (86 new commits, tip f8ab5a325)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-05-10 · Upstream tip: f8ab5a325

feat (10)

• e0a922eef feat(federation-peer): wire real midstreamer-quic@0.3.0 + aimds-core@0.2.0 (ADR-120 Step 3) (#2011) (rUv)
• b50d4dd7a feat(federation): ADR-120 Step 3 — Rust peer crate + Step 2 path update (#2009) (rUv)
• 8f5934dea feat(federation): ADR-120 Step 2 — midstream-aware transport loader (#2007) (rUv)
• ced2abc20 feat(memory): excludeFilePatterns/excludeFiles for memory_import_claude (#1937) (#1996) (rUv)
• ef73a1616 feat(ruflo-agent): rename ruflo-wasm → ruflo-agent + Claude Managed Agents (cloud) runtime — ADR-115 (proposed→accepted, implemented) (#1929) (rUv)
• 511b2ac07 feat(codex): finish Codex ↔ Ruflo integration — real codex exec, dual run --worker, tests, CI guard (#1909) (#1911) (rUv)
• 22ca3b018 feat(swarm): ADR-095 G2 — pluggable ConsensusTransport + Ed25519 message signing (step 1) (#1905) (rUv)
• 8aac1b2cc feat(mcp): ADR-112 — 285/285 tool descriptions have 'Use when …' guidance + CI guard + #1892 statusline (#1897) (rUv)
• 70e233946 feat(federation): ADR-111 Phases 4-6 — firewall projection + witness chain + MCP tools (#1895) (rUv)
• bcdeed8d1 feat(federation): ADR-111 Phases 1-3 — opt-in WireGuard mesh layer (#1894) (rUv)

fix (33)

• f8ab5a325 fix(witness): #2021 — refresh stale markers, regen signed manifest, add fast drift CI guard (ruv)
• 905672021 fix(browser): #2015 round 2 — strip bogus --kind flag, ship alpha.42 (ruv)
• e4bd9bbcb fix(verify+memory+browser): #1880, #2019, #2015 — three precondition/contract fixes + CI guards (ruv)
• d5dbfa4b9 fix(hooks): #2017 — defensive pre-bash + new CI gate against silent-swallow shape (Reuven)
• 1430b4c76 fix(embeddings): #2018 — drop @huggingface/transformers from optionalDependencies (npx Invalid Version) (Reuven)
• 455f0b17b fix(plugin-agent-federation): #1949 — agentic-flow → optional peer dep (drops cookies@0.9.1 blocker) (#2013) (rUv)
• c3ab5ef24 fix(swarm): scaleAgents targets total, executeTask catches throws (#1872) (#2000) (rUv)
• dafc567d8 fix(verify): actionable error when @noble/ed25519 isn't installed (#1880) (#1999) (rUv)
• 0873f8146 fix(mcp): protect stdout from stray console.log in stdio MCP mode (#1910) (#1998) (rUv)
• 1a1c11716 fix(deps): pin @opentelemetry/{core,resources,sdk-trace-base} to 1.25.1 (#1921) (#1997) (rUv)
• 1f8971d16 fix(init): platform-aware statusLine command (#1948) (#1995) (rUv)
• 6b9250ea8 fix(memory): memory stats HNSW count reads persistent DB (#1987) (#1993) (rUv)
• 4680a2c04 fix(statusline): guard SQLite header read on encrypted memory.db (#1989) (#1992) (rUv)
• 4bd194554 fix(neural-trader): mitigate upstream fork-bomb on install + CI guard (#1974) (#1976) (rUv)
• c8258cc07 fix(cost-tracker/compact): resolve from anywhere + free HEALTH_PORT (#1930) (#1971) (rUv)
• 8a4803020 fix(daemon): forward --workers / --headless / --sandbox to forked child (#1968) (#1970) (rUv)
• a5a638985 fix(embeddings-index): make -c optional for build/rebuild (#1947 RC2) (#1964) (rUv)
• 2c904df86 fix(memory): provision vector_indexes per namespace + truthful bridge_status (#1941, #1940) (#1963) (rUv)
• 4e6822fa8 fix(memory-import): resolve Win32 cwd to Claude Code's slug (#1939) (#1962) (rUv)
• 1d414b194 fix(hooks-pretrain): code-file budget + code-dir-first traversal (#1953) (#1961) (rUv)
• 7ca28a759 fix(statusline): read installed version from plugin package.json (#1951) (#1960) (rUv)
• 434a8f95b fix(memory): bridge + doctor honor CLAUDE_FLOW_MEMORY_PATH / config (#1945, #1946) (#1959) (rUv)
• 3657a6936 fix(hooks): pre-bash TypeError + global-install MODULE_NOT_FOUND (#1944, #1943) (#1957) (rUv)
• 4abef4b83 fix(memory): schema vector_indexes dim 768→384 + CI guard (#1947, #1942, #1952) (#1956) (rUv)
• 965ec669d fix(#1927): ruflo-cost-tracker encodeProjectPath handles Windows backslash + drive colon (#1928) (rUv)
• f0ee0f968 fix(#1921): plugin hooks use a resilient shim, not bare npx @alpha per fire (#1923) (rUv)
• 95df0111e fix(plugins): #1902/#1903/#1904 install-safety + plugin-package CI guard (#1925) (rUv)
• 31f22ff9a fix(#1916): register agent_logs + hive worker resolution + all 20 dangling CLI↔MCP tools — published 3.7.0-alpha.26 (#1924) (rUv)
• ad169de89 fix(#1914): daemon start only reaps daemons in the current workspace (#1917) (rUv)
• 16e59c261 fix(#1906): agent_execute model aliases → current Claude 4.x ids (not deprecated claude-3.x) (#1908) (rUv)
• 8403907d8 fix(#1863): guard undefined arrays in task status + cli-no-crash CI smoke (Reuven)
• 011495150 fix(#1899): ruflo-core hooks call npx ruflo@alpha not npx claude-flow@alpha (Reuven)
• d0c507e64 fix(memory): #1883 + #1884 — WSL path resolution + import-key sanitization + CI guard (#1886) (rUv)

docs (16)

• ca0a6fa5c docs(modules): publish standalone-use recipes for memory, embeddings, security + flag @ruvector/sona empty-publish blocking neural (ruv)
• cecd31085 docs(adr): ADR-120 — cross-port agentic-flow QUIC bridge into midstream + Rust in-flight agentics (#2006) (rUv)
• dc8bd3d95 docs(adr): ADR-119 — midstreamer adoption assessment (decision: wait) (#2005) (rUv)
• c328b7654 docs(plugins): aidefence 2.3.0 surface in ruflo-aidefence/-browser/-federation READMEs (#2003) (rUv)
• 194922df0 docs(adr): ADR-118 — aidefence 2.3.0 / aimds-* 0.1.1 upgrade plan (#2002) (rUv)
• 92ae6cd29 docs(readme): flag Windows install path explicitly (#1973) (#1994) (rUv)
• 639b45a66 docs(plugin): correct runtime smoke gate count 17 → 20 (#1990) (rUv)
• 4051aeeca docs(neural-trader): record 2.7.2 fix, keep --ignore-scripts as defense (#1974) (#1979) (rUv)
• 9057d5974 docs(summit): make banner link to registration + add text link below (Reuven)
• 276874adb docs: add ruFlo Summit Budapest banner asset (Reuven)
• 8c6584efd docs: link ruFlo Summit Budapest issue (#1967) from root README (Reuven)
• 545426f60 docs(adr-117): neural-trader heavy jobs on the Managed Agent cloud runtime (#1935) (rUv)
• 3975ab512 docs(ruflo-agent): bring README up to date for the managed (cloud) runtime (#1933) (rUv)
• db5321671 docs(readme): link each plugin in the "🔌 All 32 plugins" section to its README (#1932) (rUv)
• 7c1938b00 docs(adr): ADR-114 — adopt DSPy.ts as a Ruflo plugin (#1920) (rUv)
• a03f6f6ed docs(skill): verification-quality — document the actual CI guards + fix branding (Reuven)

chore (21)

• 29ea78f21 chore(release): 3.7.0-alpha.38 — ADR-120 Step 3 (Rust peer crate) + Step 2 path update (#2010) (rUv)
• 6e0ced793 chore(release): 3.7.0-alpha.37 — ADR-119 + ADR-120 + Step 2 loader (#2008) (rUv)
• 91657b9fc chore(release): 3.7.0-alpha.36 — 10 fixes + audit guard update (#2001) (rUv)
• 17986904a chore(plugin): bump pin to ^2.8.11 + add pairs/adaptive/multi-indicator smoke (#1988) (rUv)
• c37b7764b chore(plugin): bump neural-trader pin 2.7.2 → ^2.7.6 (#1982) (rUv)
• 4a19793e5 chore(release): 3.7.0-alpha.35 — ships #1974 mitigation (Reuven)
• c29ed9963 chore(release): 3.7.0-alpha.34 — ships #1968 fix + #1946/#1943/#1940 closeouts (Reuven)
• 40e94434f chore(release): 3.7.0-alpha.33 — 14 critical fixes since alpha.27 (Reuven)
• 0cdad108b chore(release): 3.7.0-alpha.32 — ships #1947 RC2 fix (Reuven)
• 6f7d04d22 chore(release): 3.7.0-alpha.31 — ships #1941 + #1940 bridge fixes (Reuven)
• 3b14b7aa9 chore(release): 3.7.0-alpha.30 — ships #1953 + #1939 fixes (Reuven)
• 3c4638bb9 chore(release): 3.7.0-alpha.29 — ships #1945 + #1946 + #1951 critical fixes (Reuven)
• 4d6e47d8a chore(release): 3.7.0-alpha.28 — ships #1947 + #1944 + #1943 critical fixes (Reuven)
• cffa55744 chore(release): 3.7.0-alpha.27 — ships managed_agent_* (ADR-115) + ruflo-wasm→ruflo-agent (#1934) (rUv)
• 3c447854d chore(release): 3.7.0-alpha.24 — ships #1906 agent_execute model-alias fix (Reuven)
• e2bc6d9ce chore(release): @claude-flow/swarm 3.0.0-alpha.7 — ADR-095 G2 consensus transport (Reuven)
• 5b36fe531 chore(release): 3.7.0-alpha.23 — ships #1863 task-status crash fix + #1899 hooks rename (Reuven)
• 7415f83ad chore(release): 3.7.0-alpha.22 — ADR-112 tool discoverability + #1889 paired-tool round-trip + #1892 statusline (Reuven)
• 31c6f9789 chore(federation): 1.0.0-alpha.15 — ships ADR-111 Phases 4-6 + Phase 7 staging (Reuven)
• f2f1fec3e chore(federation): 1.0.0-alpha.14 — ships ADR-111 Phases 1-3 (Reuven)
• c08ac2251 chore(release): 3.7.0-alpha.21 — ships #1883 + #1884 fixes (Reuven)

test (2)

• b92716b32 test(plugin): extend runtime smoke to assert advanced backtest features (#1985) (rUv)
• cad471be2 test(plugin): add runtime smoke that exercises every documented command (#1984) (rUv)

ci (2)

• 5e39e6125 ci(plugin): add neural-trader runtime-smoke workflow (#1986) (rUv)
• 131ac346a ci(guards): add fix-invariants audit covering 8 recent fixes (#1972) (rUv)

other (2)

• 5b71c7ac1 release(alpha.43+44): pin neural→sona@0.1.5, republish modules w/ standalone READMEs, add npm download badges everywhere (#2022) (ruv)
• bef3684b5 verify(federation): unblock Checks 2/3 by pinning cookies@0.9.0 (#1949) (#1965) (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)