Skip to content

Ruflo v3.32.30 — Capability Brain and self-contained policy runtime

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 29 Jul 05:49
v3.32.30
1385e21
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ruflo v3.32.30: Capability Brain, Now Complete in the Public Install

Ruflo can coordinate hundreds of agent, memory, policy, federation, and
MetaHarness capabilities—but users should not have to memorize that surface or
install unpublished internal packages to make it work. v3.32.30 makes the
public install self-contained and teaches newly initialized agents how to use
the system safely.

This is a corrective release for v3.32.29. That package exposed the new policy
runtime through a static @claude-flow/security import while declaring the
unpublished package optional. Fresh installs could run --version, but policy
and daemon command loading failed with ERR_MODULE_NOT_FOUND. v3.32.30 embeds
the reviewed Security, Codex, and federation runtimes in each applicable public
artifact and promotes their public transitive dependencies to the containing
package.

What this enables

  • Ask guidance_brain which registered Ruflo capabilities fit a task instead
    of guessing tool names.
  • Run the full policy ledger, daemon, MCP, and standard CLI command surface
    from a fresh three-package installation.
  • Generate CLAUDE.md and AGENTS.md instructions that use the Capability
    Brain, the validated implementation loop, isolated concurrent writers,
    source-bound evidence, and non-expanding authority envelopes.
  • Initialize Codex projects from the bundled adapter, including its built-in
    skills, without requiring a standalone @claude-flow/codex publication.
  • Discover the bundled federation foundation without requiring a standalone
    federation package. Production federation still requires deployment-specific
    durable storage, identity, policy, and acceptance testing.

Install or upgrade

npm install --global ruflo@3.32.30
ruflo doctor

Or run without a global install:

npx ruflo@3.32.30 --help

Use the Capability Brain

From an MCP client:

{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement, test, benchmark, and review this change with concurrent agents"
  }
}

The returned workflow follows:

recall → inspect → route → plan → execute → test → validate
       → benchmark → optimize → receipt → handoff → authorized publish

Learning, Darwin, Flywheel, and MetaHarness can propose or evaluate candidates.
They cannot promote themselves or expand tools, network access, secrets,
spending, concurrency, or release authority.

Concurrent development defaults

Generated guidance now requires:

  • one isolated worktree and explicit file scope per writing agent;
  • shared checkouts only for read-only research;
  • one integration owner for shared manifests, lockfiles, and overlap
    reconciliation;
  • continued independent work after spawning agents rather than stopping;
  • tests, benchmarks, policy decisions, and handoffs bound to an exact clean
    commit or immutable dirty-worktree snapshot.

Public package train

The normal release publishes exactly:

  • @claude-flow/cli@3.32.30
  • claude-flow@3.32.30
  • ruflo@3.32.30

The Security, Codex, and federation runtimes are built from the reviewed
monorepo source and carried as npm bundled dependencies inside the CLI and
umbrella artifacts. Their source package coordinates are not published as part
of this release.

Compatibility

  • Existing projects are never overwritten by init unless --force is used.
  • Existing guidance MCP tools remain available when guidance_brain is absent.
  • Policy migration remains legacy by default; operators can move through
    observe before enforce.
  • Optional native keychain, AgentDB, neural, and MetaHarness dependencies retain
    their existing graceful-degradation behavior.
  • ruflo, claude-flow, and @claude-flow/cli remain version-locked and
    install through their established command names.

Validation contract

Release acceptance requires:

  • the three-package version lockstep audit;
  • focused generated-guidance and Codex adapter tests;
  • Security, Codex, and federation builds and tests;
  • tarball inspection proving all three internal runtimes are bundled;
  • fresh tarball installation with optional dependencies omitted;
  • --version, policy status, daemon start/status/stop, and init --codex
    smoke tests;
  • npm ls without invalid dependency edges;
  • registry verification and aligned latest, alpha, and v3alpha tags.
Assets 2
Loading