Ruflo v3.32.37 — Complete Reports, Consistent Initialization

Ruflo v3.32.37: Complete Reports, Consistent Initialization

Ruflo v3.32.37 closes the follow-up defects found while verifying v3.32.36
against older open bug reports. MetaHarness readiness verdicts remain
machine-readable even when a repository is blocked, memory initialization
uses the same configured database path as every later operation, and dual
Claude Code/Codex initialization now installs both native surfaces.

The release also removes unbacked Codex skill placeholders, makes ADR indexing
idempotent, repairs legacy live-memory row visibility, and bounds the
quadratic work in session-end intelligence consolidation.

Install or upgrade

npm install --global ruflo@3.32.37
ruflo doctor

Existing projects remain compatible. The stable train still contains exactly
the three supported packages: @claude-flow/cli, claude-flow, and ruflo.

MetaHarness readiness is data

ruflo metaharness genome --path . --format json

Upstream MetaHarness intentionally uses exit 1 for needs-work and exit 2 for
blocked. Ruflo now preserves those valid reports instead of replacing them
with a generic subprocess error:

{
  "risk_score": 0.72,
  "verdict": "blocked",
  "verdictExitCode": 2
}

The Ruflo wrapper exits successfully for a valid report so CLI and MCP callers
can consume it. --alert-on-risk-above still exits 1 when its policy threshold
is crossed, and malformed or missing reports still fail with exit 2.

Initialization and portability

• memory init honors CLAUDE_FLOW_DB_PATH, completing the shared-path
  contract used by dual-mode bootstrap and background workers.
• init --dual runs both native initializers, preserving the full Claude Code
  scaffold while adding Codex assets.
• Root .gitignore protection covers .env secrets in initialized projects.
• Codex full init installs canonical skill implementations only; it no longer
  generates more than one hundred placeholder skills that appear usable but
  have no implementation.
• Every tracked shell and Windows hook shim now resolves the same stable Ruflo
  dist-tag.

ADR and memory correctness

• ADR metadata parsing accepts the bullet-prefixed Date, Tags, and relationship
  format emitted by adr-create.
• ADR records use explicit upsert semantics and stable keys.
• ADR relationships use deterministic semantic keys and are deduplicated
  within an import, while verification remains compatible with legacy keys.
• ADR creation guidance uses the real AgentDB key/value contract.
• Native memory CRUD treats legacy NULL status rows consistently as live.
• Intelligence consolidation deduplicates by content before graph creation and
  caps similarity comparisons while preserving temporal edges.

Validation

• Blocked-genome CLI and MCP fixtures preserve the complete verdict.
• ADR smoke: 22/22; hook-shim smoke: 12/12.
• Release gates: 12 CLI contract, 238 Codex, 559 security, and 640
  federation tests pass.
• All 23 buildable V3 workspace packages compile successfully.
• Focused MetaHarness, memory-path, dual-init, canonical-skill, ADR parser,
  ADR idempotency, memory visibility, and consolidation regressions pass.
• The stable release workflow builds immutable archives, tests the bundled
  policy/Codex/federation runtimes, installs all three archives, publishes the
  same bytes, and installs them again from the npm registry.

This patch resolves
#2626,
#2629,
#2600,
#2634,
#2636,
#2637,
#2660,
#2659,
#2651,
#2628, and
the remaining active-row visibility defect in
#2652.