v3.63.0 — Managed Agents: bounded workflows, gated controls, verified advisory learning

Minor release: @claude-flow/cli, claude-flow, ruflo 3.63.0. Adds four MCP tools for Anthropic Claude Managed Agents (managed_agent_capabilities, managed_agent_control, managed_agent_learning, managed_agent_interrupt). No leaf package changed, so no standalone publishes.

Added

• Managed cloud agents: dynamic workflows, controls and verified advisory learning (ruflo-agent 0.4.0, ruflo-workflows 0.7.0, ruflo-console 0.49.0; ADR 0003 and 0004). Everything is opt-in. A cloud agent can run bounded dynamic workflows (dynamicWorkflows: true with a mandatory budgetCents, limited networking, optional predefinedAgents); provider completion is reported as verification: "unverified". Managed sessions show up in the console's Workflows page with their budget, blockers and worker counts, with zero provider traffic from the panels. managed_agent_control inspects, interrupts or terminates one session only when the host sets RUFLO_MANAGED_CONTROL=1 and lists the session in RUFLO_MANAGED_CONTROL_SESSIONS, after a fresh read of the provider's state. With RUFLO_MANAGED_LEARNING=1 and a host-configured RUFLO_MANAGED_VERIFIER_PUBLIC_KEY, managed_agent_learning admits signed outcomes (unsigned ones stay quarantined), recommends a strategy and evaluates paired holdouts; nothing changes routing on its own.
• User guide: a "Managed cloud agents" section in docs/USERGUIDE.md.

Fixed

• memory_search_unified dropped an entry whenever the same key existed in two namespaces; it now deduplicates on namespace and key (#4470, thanks @kevin9327).
• Before this release shipped, an independent review of the managed-agent change found and fixed: managed_agent_interrupt had no host policy gate (it now uses the managed_agent_control path, and managed_agent_terminate obeys the same allowlist, deleting only the session's own environment, once RUFLO_MANAGED_CONTROL=1); managed_agent_prompt could report the previous turn's answer as finished on a later poll; several valid base64 spellings of one verifier signature were stored as separate ledger records; and the console showed rescheduling, budget-stopped and action-blocked sessions as finished.

Notes

• Known limits (ADR 0004): the verifier signs with a key in the same user account as the checks it runs, so run only host-authored checks, never ones an agent produced; evidence is only partly bound to what ran; a crashed process can leave a lock file that needs removing by hand; a session in an error state cannot be controlled. Live execution against the Anthropic Managed Agents beta has not been exercised (it needs an executor key), so treat the cloud runtime as unproven in production.
• ruflo-ai-team 0.3.5 (#4475) also changed in this tree.
• RUFLO_MANAGED_AGENTS_BASE_URL is an operator-only override of the API origin (an HTTPS origin, no credentials, path or redirects); it is never a tool argument.