@claude-flow/cli 3.32.29 → 3.32.32

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.32.29",
+    "version": "3.32.32",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
       "hook-handler.cjs": "50ea92a72651bdc95634f7588d56a5870963168eef5226f66ed14af3b47c8d9a",
@@ -8,6 +8,6 @@
       "statusline.cjs": "d2a0eac56d1267d8dbed2d70b09feb592299469196ec4b215909f2b052144882"
     }
   },
-  "signature": "jF/krskPhEF+3m0rkY3my1qEuLZec5hzo3YoV7xUl8/7xZqlpTctkB9QlYACViu2GCK3AGkWS7BRf5xR6WK7Aw==",
+  "signature": "04DvDI9kCGvy1HIskgegJsTnGUTgnDBMGTb/c+ef/hy3XgM4WvpHb6xePaWraB6YQ4F41+4BZRi4ZeBWBrVbBA==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 3,
-  "generatedAt": "2026-07-29T04:47:25.187Z",
-  "gitSha": "39bc5fd9",
+  "generatedAt": "2026-07-29T12:41:44.000Z",
+  "gitSha": "388849b3",
   "catalog": {
     "agents": 164,
     "tools": 395,

package/dist/src/autopilot-state.d.ts

@@ -61,6 +61,16 @@ export declare function validateNumber(value: unknown, min: number, max: number,
  * Returns only valid sources; falls back to defaults if none are valid.
  */
 export declare function validateTaskSources(sources: unknown): string[];
+export type TaskSourceValidation = {
+    valid: true;
+    sources: string[];
+} | {
+    valid: false;
+    invalidSources: string[];
+    reason: string;
+};
+/** Strictly validate user-supplied task sources without enabling defaults. */
+export declare function validateConfiguredTaskSources(sources: unknown): TaskSourceValidation;
 export declare function getDefaultState(): AutopilotState;
 export declare function loadState(): AutopilotState;
 export declare function saveState(state: AutopilotState): void;

package/dist/src/autopilot-state.js

@@ -74,6 +74,22 @@ export function validateTaskSources(sources) {
         .filter(s => VALID_TASK_SOURCES.has(s));
     return valid.length > 0 ? valid : defaults;
 }
+/** Strictly validate user-supplied task sources without enabling defaults. */
+export function validateConfiguredTaskSources(sources) {
+    if (!Array.isArray(sources) || sources.length === 0) {
+        return { valid: false, invalidSources: [], reason: 'At least one task source is required' };
+    }
+    const normalized = sources.map(source => typeof source === 'string' ? source.trim() : String(source));
+    const invalidSources = normalized.filter(source => !VALID_TASK_SOURCES.has(source));
+    if (invalidSources.length > 0) {
+        return {
+            valid: false,
+            invalidSources,
+            reason: `Unsupported task source(s): ${invalidSources.join(', ')}`,
+        };
+    }
+    return { valid: true, sources: [...new Set(normalized)] };
+}
 // ── State Management ──────────────────────────────────────────
 export function getDefaultState() {
     return {

package/dist/src/commands/autopilot.js

@@ -5,7 +5,7 @@
  * ADR-072: Autopilot Integration
  */
 import { output } from '../output.js';
-import { loadState, saveState, appendLog, loadLog, discoverTasks, getProgress, calculateReward, tryLoadLearning, validateNumber, validateTaskSources, LOG_FILE, } from '../autopilot-state.js';
+import { loadState, saveState, appendLog, loadLog, discoverTasks, getProgress, calculateReward, tryLoadLearning, validateNumber, validateConfiguredTaskSources, VALID_TASK_SOURCES, LOG_FILE, } from '../autopilot-state.js';
 import { getCheckpointGate, CheckpointGate } from '../services/checkpoint-gate.js';
 /**
  * Opt-in checkpoint/rollback gate for the autopilot tick (agenticow step 3).
@@ -183,7 +183,7 @@ const configCommand = {
     options: [
         { name: 'max-iterations', type: 'string', description: 'Max re-engagement iterations (1-1000)' },
         { name: 'timeout', type: 'string', description: 'Timeout in minutes (1-1440)' },
-        { name: 'task-sources', type: 'string', description: 'Comma-separated task sources' },
+        { name: 'task-sources', type: 'string', description: `Comma-separated task sources: ${[...VALID_TASK_SOURCES].join(', ')}` },
     ],
     action: async (ctx) => {
         const state = loadState();
@@ -194,8 +194,14 @@ const configCommand = {
             state.maxIterations = validateNumber(maxIter, 1, 1000, state.maxIterations);
         if (timeout)
             state.timeoutMinutes = validateNumber(timeout, 1, 1440, state.timeoutMinutes);
-        if (sources)
-            state.taskSources = validateTaskSources(sources.split(',').map(s => s.trim()).filter(Boolean));
+        if (sources !== undefined) {
+            const validation = validateConfiguredTaskSources(sources.split(',').map(s => s.trim()).filter(Boolean));
+            if (!validation.valid) {
+                output.printError(`${validation.reason}. Valid sources: ${[...VALID_TASK_SOURCES].join(', ')}`);
+                return { success: false, exitCode: 1 };
+            }
+            state.taskSources = validation.sources;
+        }
         saveState(state);
         appendLog({ ts: Date.now(), event: 'config-updated', maxIterations: state.maxIterations, timeoutMinutes: state.timeoutMinutes, taskSources: state.taskSources });
         output.writeln(`Config updated: maxIterations=${state.maxIterations}, timeout=${state.timeoutMinutes}min, sources=${state.taskSources.join(',')}`);

package/dist/src/init/claudemd-generator.js

@@ -19,6 +19,49 @@ function behavioralRules() {
 - Keep files under 500 lines
 - Validate input at system boundaries`;
 }
+function policyGovernedWorkflow() {
+    return `## Ruflo Capability Brain & Implementation Loop
+
+Ruflo is the coordination ledger and policy decision point. Claude Code is the
+executor: after a Ruflo coordination call, continue implementing the task.
+
+When it is registered, call
+\`guidance_brain({ mode: "recommend", task: "..." })\` before complex Ruflo
+work. Use its live registry instead of guessing tool names. Treat
+\`registered\`, \`configured\`, \`reachable\`, \`healthy\`, and \`authorized\`
+as separate facts. If the brain is unavailable, continue with the compatible
+\`guidance_recommend\` tool, CLI discovery, and repository instructions.
+
+Follow the returned loop:
+
+1. Recall memory and ADR constraints.
+2. Inspect source, runtime, dependencies, policy, and health.
+3. Route to the smallest capable topology, agents, skills, and tools.
+4. Plan acceptance criteria, safety envelope, ownership, and validation.
+5. Execute in isolated scopes; the coding agent performs the work.
+6. Test focused, regression, and failure paths.
+7. Validate types, security, policy, compatibility, and artifacts.
+8. Benchmark a source-bound candidate against a source-bound baseline.
+9. Optimize measured bottlenecks without weakening safety.
+10. Bind claims and evidence to exact source/build receipts.
+11. Reconcile concurrent handoffs and disclose limitations.
+12. Publish only through a separately authorized release gate.
+
+### Concurrency and authority
+
+- Never allow two writers in one worktree; give each writing agent an isolated
+  worktree and explicit file ownership.
+- Read-only research may run concurrently and report findings to the owner.
+- Only the integration owner edits shared manifests and lockfiles or reconciles
+  overlapping changes.
+- A child may drop capabilities but cannot add tools, network, secrets, spend,
+  concurrency, namespaces, or delegation depth.
+- A lease or claim coordinates ownership; it does not authorize a side effect.
+- Darwin, Flywheel, MetaHarness, memory, and neural systems may propose or
+  evaluate candidates but cannot self-promote or expand their SafetyEnvelope.
+- Bind tests, benchmarks, policy decisions, and release evidence to an exact
+  commit or immutable dirty-worktree snapshot.`;
+}
 function agentComms() {
     return `## Agent Comms (SendMessage-First Coordination)
 
@@ -61,8 +104,10 @@ SendMessage({ to: "researcher", summary: "Start", message: "[task context]" })
 - ALWAYS name agents — \`name: "role"\` makes them addressable
 - ALWAYS include comms instructions in prompts — who to message, what to send
 - Spawn ALL agents in ONE message with \`run_in_background: true\`
-- After spawning: STOP, tell user what's running, wait for results
-- NEVER poll status — agents message back or complete automatically`;
+- After spawning, continue independent local work; wait only when a dependency
+  genuinely blocks progress
+- Do not poll repeatedly — agents message back or complete automatically
+- Give every writing agent an isolated worktree and a non-overlapping file scope`;
 }
 function swarmConfig(options) {
     return `## Swarm & Routing
@@ -283,6 +328,7 @@ CLAUDE_FLOW_MEMORY_PATH=./data/memory
 const TEMPLATE_SECTIONS = {
     minimal: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => buildAndTest(),
@@ -291,6 +337,7 @@ const TEMPLATE_SECTIONS = {
     ],
     standard: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => memoryAndLearning(),
@@ -301,6 +348,7 @@ const TEMPLATE_SECTIONS = {
     ],
     full: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => memoryAndLearning(),
@@ -315,6 +363,7 @@ const TEMPLATE_SECTIONS = {
     ],
     security: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => securitySection(),
@@ -326,6 +375,7 @@ const TEMPLATE_SECTIONS = {
     ],
     performance: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => performanceSection(),
@@ -338,6 +388,7 @@ const TEMPLATE_SECTIONS = {
     ],
     solo: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         (_opts) => memoryAndLearning(),
         (_opts) => buildAndTest(),

package/dist/src/mcp-tools/autopilot-tools.js

@@ -8,7 +8,7 @@
  * @module @claude-flow/cli/mcp-tools/autopilot
  */
 import { validateText } from './validate-input.js';
-import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, validateNumber, validateTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
+import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, validateNumber, validateConfiguredTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
 function ok(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
 }
@@ -71,7 +71,12 @@ const autopilotConfig = {
         properties: {
             maxIterations: { type: 'number', description: 'Max re-engagement iterations (1-1000)' },
             timeoutMinutes: { type: 'number', description: 'Timeout in minutes (1-1440)' },
-            taskSources: { type: 'array', items: { type: 'string' }, description: `Task sources: ${[...VALID_TASK_SOURCES].join(', ')}` },
+            taskSources: {
+                type: 'array',
+                minItems: 1,
+                items: { type: 'string', enum: [...VALID_TASK_SOURCES] },
+                description: `Task sources: ${[...VALID_TASK_SOURCES].join(', ')}`,
+            },
         },
     },
     handler: async (params) => {
@@ -83,7 +88,17 @@ const autopilotConfig = {
             state.timeoutMinutes = validateNumber(params.timeoutMinutes, 1, 1440, state.timeoutMinutes);
         }
         if (params.taskSources !== undefined) {
-            state.taskSources = validateTaskSources(params.taskSources);
+            const validation = validateConfiguredTaskSources(params.taskSources);
+            if (!validation.valid) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({
+                                error: validation.reason,
+                                validSources: [...VALID_TASK_SOURCES],
+                            }) }],
+                    isError: true,
+                };
+            }
+            state.taskSources = validation.sources;
         }
         saveState(state);
         return ok({ maxIterations: state.maxIterations, timeoutMinutes: state.timeoutMinutes, taskSources: state.taskSources });

package/dist/src/mcp-tools/capability-brain.js

@@ -125,8 +125,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'guidance',
         name: 'Capability Guidance',
-        description: 'Live capability inventory, task routing, workflow guidance, and system discovery.',
         prefixes: ['guidance_'],
+        description: 'Live capability inventory, task routing, workflow guidance, and system discovery.',
         taskSignals: ['guidance', 'discover', 'capability', 'what can ruflo do'],
         commands: ['guidance compile', 'guidance retrieve', 'guidance gates', 'guidance optimize'],
         skills: [],
@@ -140,8 +140,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'identity-auth',
         name: 'Cognitum Identity & OAuth',
-        description: 'Profile-aware PKCE/OOB authentication, credential status, consent-bound scopes, refresh, and local logout.',
         prefixes: ['auth_', 'oauth_'],
+        description: 'Profile-aware PKCE/OOB authentication, credential status, consent-bound scopes, refresh, and local logout.',
         taskSignals: ['auth', 'oauth', 'login', 'logout', 'credential', 'profile', 'scope', 'consent'],
         commands: ['auth login', 'auth login --no-browser', 'auth status', 'auth status --check', 'auth logout'],
         skills: ['security-audit'],
@@ -163,8 +163,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'policy-authorization',
         name: 'Policy Authorization',
-        description: 'Policy-decision evaluation and status for exact subject/action/resource requests.',
         prefixes: ['policy_'],
+        description: 'Policy-decision evaluation and status for exact subject/action/resource requests.',
         taskSignals: ['policy', 'authorization', 'permission', 'capability', 'access control'],
         commands: ['policy evaluate', 'policy status', 'guidance gates'],
         skills: ['claims', 'security-audit', 'v3-security-overhaul'],
@@ -181,8 +181,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'work-claims',
         name: 'Exclusive Work Claims',
-        description: 'Repository/task ownership claims, handoffs, contention, stealing, and rebalance.',
         prefixes: ['claims_'],
+        description: 'Repository/task ownership claims, handoffs, contention, stealing, and rebalance.',
         taskSignals: ['work claim', 'claim task', 'handoff', 'ownership', 'concurrent work', 'rebalance'],
         commands: ['claims claim', 'claims handoff', 'claims status'],
         skills: ['claims'],
@@ -198,8 +198,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'content-safety',
         name: 'AIDefence Content Safety',
-        description: 'Prompt/content safety, PII detection, learning, and security evidence.',
         prefixes: ['aidefence_', 'security_'],
+        description: 'Prompt/content safety, PII detection, learning, and security evidence.',
         taskSignals: ['security', 'content safety', 'pii', 'prompt injection', 'threat', 'audit'],
         commands: ['security scan'],
         skills: ['security-audit', 'v3-security-overhaul'],
@@ -215,8 +215,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'metaharness-flywheel',
         name: 'MetaHarness, Darwin & Flywheel',
-        description: 'Candidate scoring, static analysis, threat modeling, genome exploration, and controlled improvement loops.',
         prefixes: ['metaharness_', 'autopilot_'],
+        description: 'Candidate scoring, static analysis, threat modeling, genome exploration, and controlled improvement loops.',
         taskSignals: ['metaharness', 'darwin', 'flywheel', 'genome', 'optimize', 'autopilot'],
         commands: ['metaharness score', 'metaharness genome', 'autopilot run'],
         skills: ['metaharness-brain', 'performance-analysis'],
@@ -233,8 +233,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'memory-knowledge',
         name: 'Memory, AgentDB & Embeddings',
-        description: 'Persistent memory, semantic/vector retrieval, namespaces, embeddings, and AgentDB controllers.',
         prefixes: ['memory_', 'agentdb_', 'embeddings_'],
+        description: 'Persistent memory, semantic/vector retrieval, namespaces, embeddings, and AgentDB controllers.',
         taskSignals: ['memory', 'agentdb', 'vector', 'embedding', 'semantic', 'recall'],
         commands: ['memory search', 'memory store', 'memory retrieve'],
         skills: ['memory-management', 'agentdb-advanced', 'agentdb-vector-search'],
@@ -250,8 +250,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'memory-branching',
         name: 'Copy-on-Write & Speculative Memory',
-        description: 'Low-cost memory branching, checkpoint, rollback, comparison, and validated promotion.',
         prefixes: ['agenticow_'],
+        description: 'Low-cost memory branching, checkpoint, rollback, comparison, and validated promotion.',
         taskSignals: ['branch memory', 'checkpoint', 'rollback', 'speculative'],
         commands: [],
         skills: ['agentdb-learning'],
@@ -267,8 +267,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'agents-runtimes',
         name: 'Agent Lifecycle & Runtimes',
-        description: 'Local agents, managed cloud agents, WASM sandboxes, and inference runtimes.',
         prefixes: ['agent_', 'managed_agent_', 'wasm_agent_', 'wasm_gallery_', 'ruvllm_'],
+        description: 'Local agents, managed cloud agents, WASM sandboxes, and inference runtimes.',
         taskSignals: ['agent', 'worker', 'wasm', 'sandbox', 'inference', 'managed agent'],
         commands: ['agent spawn', 'agent status', 'agent stop'],
         skills: ['agent-coder', 'agent-tester', 'agent-reviewer'],
@@ -284,8 +284,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'swarm-coordination',
         name: 'Swarm & Coordination',
-        description: 'Topology-aware multi-agent coordination, task ownership, and collective scheduling.',
         prefixes: ['swarm_', 'coordination_', 'daa_'],
+        description: 'Topology-aware multi-agent coordination, task ownership, and collective scheduling.',
         taskSignals: ['swarm', 'concurrent', 'parallel', 'coordinate', 'multi-agent'],
         commands: ['swarm init', 'swarm status', 'swarm coordinate'],
         skills: ['swarm-orchestration', 'swarm-advanced'],
@@ -299,8 +299,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'consensus-federation',
         name: 'Hive Mind & Consensus',
-        description: 'Hive, quorum, voting, gossip, and distributed agreement primitives.',
         prefixes: ['hive_', 'hive-mind_', 'consensus_', 'quorum_'],
+        description: 'Hive, quorum, voting, gossip, and distributed agreement primitives.',
         taskSignals: ['hive', 'consensus', 'quorum', 'byzantine', 'federation'],
         commands: ['hive-mind init', 'hive-mind status'],
         skills: ['hive-mind', 'hive-mind-advanced'],
@@ -314,8 +314,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'tasks-workflows-sessions',
         name: 'Tasks, Workflows, Sessions & Progress',
-        description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         prefixes: ['task_', 'workflow_', 'session_', 'progress_'],
+        description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         taskSignals: ['task', 'workflow', 'session', 'handoff', 'progress'],
         commands: ['task create', 'task status', 'workflow run'],
         skills: ['workflow-automation'],
@@ -329,8 +329,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'hooks-learning-routing',
         name: 'Hooks, Coverage & Learning Routing',
-        description: 'Lifecycle hooks, coverage-aware routing, background workers, and validated pattern capture.',
         prefixes: ['hooks_', 'coverage_'],
+        description: 'Lifecycle hooks, coverage-aware routing, background workers, and validated pattern capture.',
         taskSignals: ['hook', 'coverage', 'route', 'worker', 'learning'],
         commands: ['hooks pre-task', 'hooks post-task', 'hooks route', 'hooks coverage-gaps'],
         skills: ['hooks-automation'],
@@ -345,8 +345,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'analysis-quality',
         name: 'Analysis & Quality',
-        description: 'Code/project analysis, quality assessment, and change inspection.',
         prefixes: ['analyze_', 'analysis_'],
+        description: 'Code/project analysis, quality assessment, and change inspection.',
         taskSignals: ['analyze', 'review', 'quality', 'dependency'],
         commands: ['analyze code', 'analyze project'],
         skills: ['verification-quality'],
@@ -360,8 +360,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'test-generation',
         name: 'TDD Test Generation',
-        description: 'TDD repair and test-generation capability exported by Ruflo but intentionally reported as unregistered until the MCP registry enables it.',
         prefixes: ['testgen_'],
+        description: 'TDD repair and test-generation capability exported by Ruflo but intentionally reported as unregistered until the MCP registry enables it.',
         exactTools: ['testgen_tdd_repair'],
         taskSignals: ['generate tests', 'tdd repair', 'test generation'],
         commands: [],
@@ -379,8 +379,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'performance-neural',
         name: 'Performance & Neural Optimization',
-        description: 'Profiling, benchmarks, learned routing, pattern training, and optimization.',
         prefixes: ['performance_', 'neural_'],
+        description: 'Profiling, benchmarks, learned routing, pattern training, and optimization.',
         taskSignals: ['performance', 'benchmark', 'profile', 'latency', 'neural', 'train'],
         commands: ['performance benchmark', 'performance profile', 'neural train'],
         skills: ['performance-analysis', 'neural-training'],
@@ -396,8 +396,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'browser-web',
         name: 'Browser & Web Actions',
-        description: 'Browser sessions, page actions, intent routing, and guarded HTTP probes.',
         prefixes: ['browser_', 'http_fetch'],
+        description: 'Browser sessions, page actions, intent routing, and guarded HTTP probes.',
         taskSignals: ['browser', 'web page', 'navigate', 'click', 'http', 'fetch'],
         commands: ['browser open', 'browser act'],
         skills: [],
@@ -413,8 +413,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'github-delivery',
         name: 'GitHub & Delivery',
-        description: 'Issues, pull requests, workflows, releases, repository automation, and handoff.',
         prefixes: ['github_', 'pr_', 'release_'],
+        description: 'Issues, pull requests, workflows, releases, repository automation, and handoff.',
         taskSignals: ['github', 'issue', 'pull request', 'merge', 'release', 'publish'],
         commands: ['github pr', 'github release'],
         skills: ['github-automation', 'github-release-management'],
@@ -429,9 +429,9 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'business-collaboration',
         name: 'AgentBBS & Business Pods',
-        description: 'Federated business rooms, domain-affinity routing, and business-pod validation.',
         // Metadata classification only; execution remains behind the existing loadAgentbbs guard.
         prefixes: ['agentbbs_', 'business_pod_', 'federation_bbs_'],
+        description: 'Federated business rooms, domain-affinity routing, and business-pod validation.',
         taskSignals: ['business pod', 'bbs', 'room', 'domain affinity'],
         commands: [],
         skills: [],
@@ -447,8 +447,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'configuration-transfer',
         name: 'Configuration & Transfer',
-        description: 'Configuration state plus portable import, export, backup, and migration.',
         prefixes: ['config_', 'transfer_'],
+        description: 'Configuration state plus portable import, export, backup, and migration.',
         taskSignals: ['config', 'setup', 'import', 'export', 'backup', 'migrate'],
         commands: ['config show', 'memory export'],
         skills: [],
@@ -463,8 +463,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'system-terminal',
         name: 'System & Terminal Compatibility',
-        description: 'System diagnostics and legacy-compatible terminal execution surfaces.',
         prefixes: ['system_', 'terminal_', 'mcp_'],
+        description: 'System diagnostics and legacy-compatible terminal execution surfaces.',
         taskSignals: ['terminal', 'shell', 'doctor', 'system status'],
         commands: ['doctor', 'status'],
         skills: [],
@@ -479,8 +479,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'runtime-services',
         name: 'Other Registered Runtime Services',
-        description: 'Live MCP tools not yet assigned to a specialized domain; included so coverage is never silently incomplete.',
         prefixes: [],
+        description: 'Live MCP tools not yet assigned to a specialized domain; included so coverage is never silently incomplete.',
         taskSignals: [],
         commands: [],
         skills: [],

package/dist/src/mcp-tools/guidance-tools.js

@@ -814,7 +814,7 @@ const guidanceQuickRef = {
 };
 const guidanceBrain = {
     name: 'guidance_brain',
-    description: 'Query Ruflo’s live capability brain. Covers every registered MCP tool, separates registration from configuration/reachability/health/authorization, recommends capabilities for a task, and returns the validated implementation loop.',
+    description: 'Use when choosing how to execute a task with Ruflo. Queries the live capability brain, covers every registered MCP tool, separates registration from configuration/reachability/health/authorization, recommends capabilities, and returns the validated implementation loop.',
     inputSchema: {
         type: 'object',
         properties: {

package/dist/src/services/harness-flywheel-runtime.d.ts

@@ -1,6 +1,26 @@
 import { type FlywheelResult } from './harness-flywheel.js';
 import { type GenerationResult } from './harness-flywheel-generations.js';
-import { type DarwinInvoker, type ProposerMode } from './flywheel-proposer.js';
+import { type DarwinInvoker, type ProposerMode, type SafetyEnvelope } from './flywheel-proposer.js';
+/**
+ * The ADR-322 retrieval safety envelope.
+ *
+ * It MUST describe the policy surface the proposer actually emits —
+ * `RetrievalConfig`. The v1 envelope allowed `topK`/`rerank`, which are
+ * `neural_patterns` search-call arguments not representable in
+ * `RetrievalConfig`, while omitting the three weight axes that
+ * `retrievalPolicyNeighbors` does mutate. Because `validateCandidate` checks
+ * EVERY key of a candidate policy (candidates are full snapshots, not deltas),
+ * that drift made every locally-proposed candidate inadmissible and the local
+ * evaluation path unreachable — no receipt, therefore no promotion, ever.
+ *
+ * Every axis carries a finite bound: an allowed key WITHOUT bounds is an
+ * unbounded key, because `validateCandidate` applies bounds only when present.
+ * A Darwin proposer could otherwise submit arbitrary weights on the three axes.
+ *
+ * Exported so tests can bind the REAL envelope to the REAL proposer; the drift
+ * survived review precisely because no test wired those two together.
+ */
+export declare function retrievalSafetyEnvelope(ref?: string): SafetyEnvelope;
 /**
  * Run one live flywheel tick against `projectRoot`. Opt-in + $0 default: with
  * RUFLO_HARNESS_LOOP unset it is a no-op. Best-effort; never throws.

package/dist/src/services/harness-flywheel-runtime.js

@@ -24,6 +24,51 @@ const ANCHOR = [
     ['Q-learning encoder keyword block', ['q-state encoder', 'route q-state', 'keyword block', '#2239', 'q-encoder']],
     ['security hardening crypto random IDs', ['cwe-347', 'crypto.randomuuid', 'security fix', 'random id', 'crypto random']],
 ].map(([q, labels], i) => ({ id: `q${String(i).padStart(2, '0')}`, input: { id: `q${String(i).padStart(2, '0')}`, q: q }, expected: labels }));
+/**
+ * The ADR-322 retrieval safety envelope.
+ *
+ * It MUST describe the policy surface the proposer actually emits —
+ * `RetrievalConfig`. The v1 envelope allowed `topK`/`rerank`, which are
+ * `neural_patterns` search-call arguments not representable in
+ * `RetrievalConfig`, while omitting the three weight axes that
+ * `retrievalPolicyNeighbors` does mutate. Because `validateCandidate` checks
+ * EVERY key of a candidate policy (candidates are full snapshots, not deltas),
+ * that drift made every locally-proposed candidate inadmissible and the local
+ * evaluation path unreachable — no receipt, therefore no promotion, ever.
+ *
+ * Every axis carries a finite bound: an allowed key WITHOUT bounds is an
+ * unbounded key, because `validateCandidate` applies bounds only when present.
+ * A Darwin proposer could otherwise submit arbitrary weights on the three axes.
+ *
+ * Exported so tests can bind the REAL envelope to the REAL proposer; the drift
+ * survived review precisely because no test wired those two together.
+ */
+export function retrievalSafetyEnvelope(ref) {
+    const allowedPolicyKeys = ['alpha', 'subjectWeight', 'mmrLambda', 'bodyWeight', 'typePenaltyFactor'];
+    const numericBounds = {
+        alpha: { min: 0.1, max: 0.9 },
+        subjectWeight: { min: 0.1, max: 10 },
+        mmrLambda: { min: 0.3, max: 0.9 },
+        bodyWeight: { min: 0.1, max: 10 },
+        typePenaltyFactor: { min: 0.1, max: 10 },
+    };
+    return {
+        ref: ref ?? sha256Ref(JSON.stringify({
+            schema: 'ruflo.retrieval-safety-envelope/v2',
+            allowedPolicyKeys,
+            numericBounds,
+        })),
+        allowedPolicyKeys,
+        numericBounds,
+        // Retrieval evaluations are local and report zero provider spend today;
+        // finite ceilings make any future resource evidence fail closed.
+        maxP95LatencyMicros: 5_000_000,
+        maxCostMicrosPerTask: 10_000,
+        maxTokensPerTask: 100_000,
+        maxFailureRate: 0.01,
+        maxEvaluationCostMicros: 1_000_000,
+    };
+}
 /**
  * Run one live flywheel tick against `projectRoot`. Opt-in + $0 default: with
  * RUFLO_HARNESS_LOOP unset it is a no-op. Best-effort; never throws.
@@ -53,30 +98,7 @@ export async function runFlywheelWorker(projectRoot, opts = {}) {
             ...DEFAULT_CONFIG,
             ...(applier.activeChampion(projectRoot)?.params ?? {}),
         };
-        const safetyEnvelope = {
-            ref: opts.safetyEnvelopeRef ?? sha256Ref(JSON.stringify({
-                schema: 'ruflo.retrieval-safety-envelope/v1',
-                allowedPolicyKeys: ['alpha', 'topK', 'rerank', 'mmrLambda'],
-                numericBounds: {
-                    alpha: { min: 0.1, max: 0.9 },
-                    topK: { min: 5, max: 20 },
-                    mmrLambda: { min: 0.3, max: 0.9 },
-                },
-            })),
-            allowedPolicyKeys: ['alpha', 'topK', 'rerank', 'mmrLambda'],
-            numericBounds: {
-                alpha: { min: 0.1, max: 0.9 },
-                topK: { min: 5, max: 20 },
-                mmrLambda: { min: 0.3, max: 0.9 },
-            },
-            // Retrieval evaluations are local and report zero provider spend today;
-            // finite ceilings make any future resource evidence fail closed.
-            maxP95LatencyMicros: 5_000_000,
-            maxCostMicrosPerTask: 10_000,
-            maxTokensPerTask: 100_000,
-            maxFailureRate: 0.01,
-            maxEvaluationCostMicros: 1_000_000,
-        };
+        const safetyEnvelope = retrievalSafetyEnvelope(opts.safetyEnvelopeRef);
         // CLI flag opts.proposer takes precedence over RUFLO_FLYWHEEL_PROPOSER.
         const proposerMode = opts.proposer
             ?? (process.env.RUFLO_FLYWHEEL_PROPOSER ?? 'auto');

package/node_modules/@claude-flow/codex/.agents/skills/memory-management/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: memory-management
+description: >
+  AgentDB memory system with HNSW vector search.
+  Use when: need to store patterns, search for solutions, semantic lookup.
+  Skip when: no learning needed, ephemeral tasks.
+---
+
+# Memory Management Skill
+
+## Purpose
+AgentDB memory system with HNSW vector search.
+
+## When to Trigger
+- need to store patterns
+- search for solutions
+- semantic lookup
+
+## When to Skip
+- no learning needed
+- ephemeral tasks
+
+## Commands
+
+### Store Data
+Store a pattern in memory
+
+```bash
+npx @claude-flow/cli memory store --key "key" --value "value" --namespace patterns
+```
+
+### Search Data
+Semantic search in memory
+
+```bash
+npx @claude-flow/cli memory search --query "search terms" --limit 10
+```
+
+
+
+## Best Practices
+1. Check memory for existing patterns before starting
+2. Use hierarchical topology for coordination
+3. Store successful patterns after completion
+4. Document any new learnings