Ruflo v3.32.33 — Exact Autopilot Scope and Governed Flywheel Candidates

Ruflo v3.32.33: Autopilot Scope Enforcement at the Real CLI Boundary

v3.32.33 completes the Flywheel and Autopilot reliability release by enforcing
explicit task-source validation through the same normalized flags users pass
to the CLI.

The V3 parser converts kebab-case options such as --task-sources and
--max-iterations to taskSources and maxIterations. The initial validation
implementation correctly rejected unsupported values at the service and MCP
layers but read the legacy kebab-case keys in the CLI action. As a result, the
real command ignored the supplied value and persisted the default source set.

This release reads the parser's canonical camelCase keys while retaining the
legacy keys for direct action callers. A parser-to-command integration test and
an immutable-tarball release smoke now prove that unsupported task sources fail
without creating state.

Install or upgrade

npm install --global ruflo@3.32.33
ruflo doctor

Configure an exact Autopilot scope

ruflo autopilot config \
  --task-sources swarm-tasks,file-checklist \
  --max-iterations 77

Unsupported sources fail and leave the stored configuration unchanged:

ruflo autopilot config --task-sources issues

Flywheel fix included

The release also includes the v2 retrieval safety envelope from #2836. The
built-in proposer can evaluate bounded full-policy candidates without gaining
promotion authority.

ruflo metaharness flywheel status
ruflo metaharness flywheel run --proposer local

Release lineage

• v3.32.31 stopped before npm publication because its helper manifest was
  signed for the prior version.
• v3.32.32 corrected the signed manifest and was published, but independent
  post-registry validation found the CLI flag-normalization mismatch.
• v3.32.33 is the validated release and receives the stable npm tags.