ruflo updates — week of 2026-05-24 (130 new commits, tip 619b263aa)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-05-17 · Upstream tip: 619b263aa

feat (34)

• 9a66b2996 feat(ci): #2095 ADR-128 Phase 5 — init-bundle-invariants smoke (no orphans, no plugin-init overlap) (ruv)
• 0740b2fa1 feat(init): #2095 ADR-128 Phase 4 — delete 9 orphan command files (unreachable from COMMANDS_MAP) (ruv)
• 34e7b1e9f feat(init): #2095 ADR-128 Phase 3 — opt-in domain-specific agent categories (98 → ~17 by default) (ruv)
• 865c901af feat(init): #2095 ADR-128 Phase 2 — remove 9 forked agents (let plugins own them) (ruv)
• c63905e6a feat(init): #2095 ADR-128 Phase 1 — ship 29 skills inside @claude-flow/cli package (ruv)
• 1eece3afc feat(init): #2089 ADR-127 Phase 4 — attribution opt-in across 19 github command files + last-updated stamps (ruv)
• 388665d67 feat(ci): #2089 ADR-127 Phase 3 — bump actions/checkout + setup-node to v4 + deprecated-actions smoke (ruv)
• 7d2fc001e feat(security): #2089 ADR-127 Phase 2 — github-safe maxBuffer + agent frontmatter tools: + swarm-pr/issue injection fix (ruv)
• 90df1d6e8 feat(ci): #2089 ADR-127 Phase 1 — github-safe injection smoke + uses: pin smoke + supply-chain allowed-deps actions block (ruv)
• 70861ced4 feat(neural-trader): #48 — benchmark suite (signal, backtest, memory-recall) (ruv)
• e073b38fe feat(neural-trader): #55 — wire native sublinear CG dispatch (40-60× when available) (ruv)
• 11c1ad974 feat(neural-trader): #2068 ADR-126 Phase 6 — feature attribution via single-entry PR (ruv)
• f8485c7b7 feat(neural-trader): #2068 ADR-126 Phase 5 — SendMessage risk-gate pipeline (ruv)
• 48cb0a7ee feat(neural-trader): #2068 ADR-126 Phase 4 — Ed25519-signed backtest artifacts (ruv)
• 9c075a3c3 feat(neural-trader): #2068 ADR-126 Phase 3 — portfolio CG via sublinear/solve (40-60x) (ruv)
• d9bd4e6ad feat(neural-trader): #2068 ADR-126 Phase 2 — ADR-125 memory lifecycle (TTL + dedup + warm HNSW doc) (ruv)
• 1cd98afaa feat(data): clone tracker with 13-day cron + RVF + proof, bump downloads badge to 22.2M+ (ruv)
• 8773fcffd feat(memory): #2061 ADR-125 Phase 5 — graceful retrieval degradation + FTS5 keyword fallback (ruv)
• 850450f38 feat(memory): #2061 ADR-125 Phase 4 — MemoryConsolidator (sweep + dedup + compactHnsw) (ruv)
• 81a2b23eb feat(memory): #2061 ADR-125 Phase 3 — persistent HNSW snapshot + restore (ruv)
• ed95d6782 feat(memory): #2061 ADR-125 Phase 6 — runnable benchmarks + baseline results (ruv)
• 11eaef851 feat(memory): #2061 ADR-125 Phase 2 — wire createHybridService to actually use HybridBackend (ruv)
• 4e9a33ce2 feat(memory): #2061 ADR-125 Phase 1 — MemoryService canonical entry point + deprecate UnifiedMemoryService (ruv)
• 3cec3bf94 feat(graph-intelligence): #2044 ADR-123 Phase 8 — federation distribution of signed PR vectors (ruv)
• ed81567cd feat(graph-intelligence): #2044 ADR-123 Phases 6.5+7 — streaming bridge + signed PR artifacts (beyond-SOTA) (ruv)
• dbb88fdc3 feat(graph-intelligence): #2044 ADR-123 Phases 5+6 — portfolio CG + AIDefence + jujutsu + JL + GOAP-LP (ruv)
• 645f31a06 feat(graph-intelligence): #2044 ADR-123 Phases 2-4 — 5 adapters across 5 wedges (ruv)
• 126c23a0f feat(graph-intelligence): #2044 ADR-123 Phase 1 — ruflo-graph-intelligence plugin foundation (ruv)
• 350bcf060 feat(browser): #2041 ADR-122 Phase 7 — Workflow Compiler + production-aware UCT (ruv)
• 45f951143 feat(browser): #2041 ADR-122 Phase 6 + substrate reframing — Session Capsule + adapters + risk classes (ruv)
• a0d3d01c3 feat(browser): #2041 ADR-122 Phase 5 — cost-aware routing + GOAP preflight (ruv)
• dfb7747b3 feat(browser): #2041 ADR-122 Phase 3 + Phase 4 — attested cookie vault + federated MCTS (ruv)
• 8d10e1aa8 feat(browser): #2041 ADR-122 Phase 1 MCP + Phase 2 causal recovery (ruv)
• 5fedd1d02 feat(browser): #2041 ADR-122 Phase 0 + Phase 1 — agent-browser 0.27 + signed trajectories (ruv)

fix (25)

• a77814807 fix(daemon): #2110 — WSL2 silent-degrade triple fix + alpha.81 (ruv)
• 6ac3156dc fix(deps): #2112 — opentelemetry transitives overrides on ruflo wrapper (alpha.80) (ruv)
• 0e1d26c11 fix(security): patch CVEs, shell injection, SSRF in ruflo (#2114) (rUv)
• 5b8e3ad0f fix(deps): patch 3 moderate CVEs via npm overrides — qs DoS, protobufjs DoS, express qs-chain (#2113) (rUv)
• 1eebc724f fix(smoke): #2042 — make providers smoke static-only (no build dependency) (ruv)
• 94b98c90c fix(mcp): #2042 — agent_execute routes through v3 provider system (Anthropic / OpenRouter / Ollama) (ruv)
• 6b7d64bcb fix(init): #2078 — generated CLAUDE.md rule overrides Claude Code's default Co-Authored-By trailer (ruv)
• ad429d154 fix(cli,daemon,mcp): #2098 #2093 #2085 — three regressions reported on alpha.75 (ruv)
• b4e177667 fix(github): #2089 — complete Phase 3 (5 init-template agents missed) + strengthen smoke + alpha.75 (ruv)
• 4327ec9ff fix(smoke): #2089 — accept E2BIG as valid rejection in github-safe injection smoke (ruv)
• bc1f587c0 fix(mcp): #2086 — auto-init ruvllm WASM in loadRuvllmWasm + CI regression guard (ruv)
• a01d75299 fix(ruflo-graph-intelligence): make plugin.json repository field a string (#2066) (Dr. Mark Allen)
• 7bdcd58db fix(init): #2078 — use no-reply bot email for opt-in Co-Authored-By (ruv)
• 0c31cbad4 fix(memory): #2073 — export returns real value + --value-only pipe-friendly retrieve (ruv)
• f615ea947 fix(cost-tracker): spawnSync npx ENOENT on Windows (ttxenonmarketing-ux)
• 8d9e20f0c fix(neural-trader): #2068 ADR-126 Phase 1 — canonical 5-namespace alignment (was bug) (ruv)
• 82edec30f fix(security): #1922 — verify plugin-registry Ed25519 signature properly (CWE-347) (ruv)
• 3dbf6074a fix(deps): #2048 — bump agentic-flow ^2.0.12 → ^2.0.13 (Windows onnxruntime lazy-load) (ruv)
• 21e52108d fix(kg-extract): #2049 — separate import type from value imports + drop disabled semantic-route + CI guard (ruv)
• e90163ace fix(ci): #2046 move dependency-review continue-on-error to STEP level (ruv)
• d6792a087 fix(ci): #2046 dependency-review needs Dependency Graph enabled — make non-blocking (ruv)
• bc5561d59 fix(ci): #2046 dependency-review deny-packages must be pURL format (ruv)
• f60417352 fix(deps): #2046 ADR-124 — bump agentic-flow to 2.0.12 (xenova optional) (ruv)
• 9a8c9c464 fix(supply-chain): #2046 — eliminate all root-level HIGH/CRITICAL CVEs (ruv)
• 36d8195a9 fix(graph-intelligence): #2044 ADR-123 — add .claude-plugin/plugin.json for marketplace validate (ruv)

perf (4)

• cff24dbff perf(guidance): M4 quantization — 1-bit RaBitQ-style signatures, 2.7x at N=1000 (ruv)
• 12ecb39cb perf(guidance): M3 substrate — packed embedding matrix + filtered-query bench coverage (ruv)
• 6d6d659ca perf(guidance): Phase 1 — hot-path cleanup + scaling benchmark infrastructure (ruv)
• bb05c5a96 perf(neural-trader): #49 — bench-driven perf notes + targeted optimization (ruv)

docs (13)

• 619b263aa docs(claude.md): switch publishing policy from alpha to stable semver (ruv)
• 166ee7f25 docs(adr): ADR-128 — init bundle reduce + refactor + skill source-of-truth fix (ruv)
• 656efcdbe docs(adr-127): correct inventory — 5 github skills, not 4 (ruv)
• 5c1d92951 docs(adr): ADR-127 — GitHub stack modernization (CI guards, supply-chain, provenance) (ruv)
• 10db8e459 docs(readme): add RuFlo Agentic Appliance banner linking to cognitum.one/appliance (ruv)
• 4def69f00 docs: add ruflo-graph-intelligence to plugin list + reshuffle featured installs (ruv)
• f8974c74c docs: trim redundant per-package npm badges from root + ruflo READMEs (ruv)
• 32612ecdf docs: fix badge links + add ecosystem badges to root + ruflo READMEs (ruv)
• 415b7921f docs(memory): bump downloads badge to 5.6M+ ecosystem total (ruv)
• 581597aca docs(memory): add accurate 3.2M+ downloads badge (ruv)
• 6e1370963 docs(memory): #2061 update README for 3.0.0-alpha.18 / ADR-125 (ruv)
• 116613e93 docs(ruflo-browser): #2041 link plugin to ADR-122 substrate (ruv)
• 72d31a00a docs(browser): #2041 ADR-122 security audit + substrate benchmarks + announcement draft (ruv)

chore (13)

• b5cd79c26 chore(data): clone snapshot ruflo updates — week of 2026-05-10 (243 new commits, tip 5f0c8455c) #3 — 0 clones (14d) (ruflo-bot)
• a75d733f0 chore(release): 3.7.0-alpha.79 — guidance 2.70x quantization win (ruv)
• 8e97433f6 chore(release): publish 3.7.0-alpha.78 — #2042 #2078 fixes (ruv)
• 2bc91f7cc chore(release): publish 3.7.0-alpha.77 — #2098 #2093 #2085 fixes (ruv)
• 1ce81a3e3 chore(release): publish 3.7.0-alpha.76 — ADR-128 init bundle reduce + refactor (ruv)
• fa790f096 chore(release): publish 3.7.0-alpha.72 — #2073 memory export/retrieve fix (ruv)
• c1ca903a7 chore(data): clone snapshot ruflo updates — week of 2026-05-03 (69 new commits, tip 43c8fd794) #2 — 0 clones (14d) (ruflo-bot)
• 27e91c7fb chore(release): publish 3.7.0-alpha.71 + @claude-flow/memory@3.0.0-alpha.18 (ruv)
• 7dd4b5252 chore(memory): #2061 ADR-125 Phase 7 — RuVector boundary cleanup + no-stray-db CI smoke (ruv)
• 4de8846c7 chore(release): publish 3.7.0-alpha.70 — CWE-347 security fix (ruv)
• 9b4ce6d99 chore(deps): #2046 — refresh v3/pnpm-lock.yaml for agentic-flow 2.0.3→2.0.11 (ruv)
• 87f2a26cd chore(deps): #2041 ADR-122 — refresh v3/pnpm-lock.yaml for agent-browser 0.27 (ruv)
• 338f7320a chore(deps): #2041 ADR-122 — refresh root package-lock for agent-browser 0.27 bump (ruv)

ci (3)

• 0181fb85c ci: #2046 supply-chain hardening — five-layer audit + dependency review + CODEOWNERS (ruv)
• cc007d952 ci: #2041 ADR-122 — make browser rvf smoke tolerant of missing dist (ruv)
• 62aa08f49 ci: #2041 ADR-122 — browser rvf smoke uses pnpm (workspace:* protocol) (ruv)

other (38)

• 1af3b1875 Merge pull request #2118 from ruvnet/fix/2110-wsl2-daemon-three-bugs (rUv)
• 6bcee19ad Merge pull request #2115 from ruvnet/fix/2112-otlp-overrides-on-published-packages (rUv)
• 3f861eed9 Merge pull request #2103 from ruvnet/perf/guidance-phase-1-hotpath-optimizations (rUv)
• a226f2bcd Merge pull request #2102 from ruvnet/fix/2042-agent-execute-provider-routing (rUv)
• 93ffedd6b Merge pull request #2101 from ruvnet/fix/2078-claudemd-coauthor-rule (rUv)
• f4d35528b Merge pull request #2100 from ruvnet/fix/2098-2085-three-bugs (rUv)
• c288d9df1 Merge pull request #2096 from ruvnet/docs/adr-128-init-bundle-reduce-refactor (rUv)
• 239d1c904 Merge pull request #2097 from ruvnet/impl/adr-128-init-bundle-reduce-refactor (rUv)
• 1a26c2b6c Merge pull request #2090 from ruvnet/docs/adr-127-github-stack-modernization (rUv)
• 80627d19f Merge pull request #2094 from ruvnet/impl/adr-127-github-stack-modernization (rUv)
• a4d8f2aa8 Merge pull request #2088 from ruvnet/fix/2086-ruvllm-wasm-auto-init (rUv)
• e017ee611 Update README.md (rUv)
• 6d50dd853 Merge pull request #2081 from ruvnet/feat/48-49-50-bench-perf-security (rUv)
• 8a9c6ee53 security(neural-trader): #50 — supply-chain audit + AIDefence wiring sketch (ruv)
• eb59a9344 Merge pull request #2080 from ruvnet/feat/55-native-cg-dispatch (rUv)
• 71bc21b1a Merge pull request #2079 from ruvnet/fix/2078-attribution-bot-email (rUv)
• 9f244ea16 Merge pull request #2074 from Observator01/fix/cost-tracker-windows-spawn (rUv)
• 0ca480b35 Merge pull request #2077 from ruvnet/fix/2073-memory-export-value-null (rUv)
• ceae52ac3 Merge pull request #2072 from ruvnet/feat/adr-126-phase-6-feature-attribution (rUv)
• 493721fd5 Merge pull request #2071 from ruvnet/feat/adr-126-phase-4-5-trust-pipeline (rUv)
• e2df533ee Merge pull request #2070 from ruvnet/feat/adr-126-phase-3-portfolio-cg (rUv)
• 4937ead42 Merge pull request #2069 from ruvnet/feat/adr-126-neural-trader-substrate (rUv)
• e5c64d740 adr: ADR-126 — ruflo-neural-trader substrate integration (ruv)
• 3d2afa07c Merge pull request #2067 from ruvnet/docs/trim-redundant-badges (rUv)
• 0c63df611 Merge pull request #2065 from ruvnet/docs/memory-readme-adr-125 (rUv)
• f2d123c24 Merge pull request #2063 from ruvnet/feat/adr-125-pr-b-harden (rUv)
• a015d5860 Merge pull request #2062 from ruvnet/feat/adr-125-memory-consolidation (rUv)
• d2a103f44 Merge pull request #2060 from ruvnet/feat/cwe-347-plugin-registry-signature-verify (rUv)
• 37b3760b2 Merge pull request #2056 from ruvnet/feat/agentic-flow-2.0.13-bump (rUv)
• 6080d5740 Merge pull request #2055 from ruvnet/feat/issue-2047-2048-2049-fixes (rUv)
• 66153bfc1 Merge pull request #2050 from ruvnet/feat/ci-supply-chain-hardening (rUv)
• b28c8a429 Register ruflo-graph-intelligence in marketplace manifest (#2051) (Ofer Shaal)
• ec8e6f2ed Remove duplicate lowercase skill.md files (#2052) (Ofer Shaal)
• c292e5fcf Merge pull request #2045 from ruvnet/feat/adr-123-sublinear-integration (rUv)
• 05010fce3 adr: ADR-123 — reframe as Graph Intelligence Engine with complexity-aware execution (ruv)
• c3cab70e2 adr: ADR-123 — track upstream sublinear-time-solver@1.7.0 (ruv)
• 06cbb77dc adr: ADR-123 — sublinear-time-solver integration into RuFlo (ruv)
• 0ddf1dfa4 Merge pull request #2043 from ruvnet/feat/adr-122-browser-beyond-sota (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)