feat(plugins): ADR-098 Part 1 (slice 1/3) — capability sync for security plugins

Adds ADR-095/096 + audit_1776853149979 references to ruflo-aidefence
and ruflo-security-audit. End users installing either plugin now see
the host hardening features that pair with the plugin's threat
detection / scanning, not just the plugin's own surface.

ruflo-aidefence/README.md:
  New "Defense-in-depth pairing (ruflo 3.6.25+)" section listing:
  - validateEnv() loader-hijack denylist (LD_PRELOAD, NODE_OPTIONS,
    DYLD_*, etc.) at the terminal_create MCP boundary
  - File mode 0600 / dir mode 0700 on session/terminal/memory stores
    via fs-secure
  - Encryption at rest (CLAUDE_FLOW_ENCRYPT_AT_REST=1, AES-256-GCM,
    RFE1 magic-byte sniff)
  Threat scoring should account for whether the host is a denylist-
  enforcing / encrypted-at-rest install.

ruflo-security-audit/README.md:
  New "Patterns to scan for (audit_1776853149979 follow-up)" section
  with six concrete antipatterns + remediation pointers:
  - execSync(string) with template-literal args (4 closed sites cited)
  - Numeric MCP inputs cast as `number` without runtime check
  - Untrusted package specs flowing into npm install
  - Loader-hijack env vars
  - Plaintext at-rest secrets paired with ADR-096
  - MCP stdin DoS (10MB cap reference)
  Plus a `ruflo verify` reference confirming 55 witnesses on disk.

Plugin versions:
  ruflo-aidefence       0.1.0 → 0.2.0 (minor — capability sync)
  ruflo-security-audit  0.1.1 → 0.2.0 (minor — capability sync,
                                       was patch from iter #55 model
                                       fix)

Two more slices remain for Part 1:
  - slice 2: ruflo-rag-memory + ruflo-rvf — encryption-at-rest gate
    notes
  - slice 3: ruflo-cost-tracker — federation budget breaker pairing,
    federation_spend events
  - slice 4: ruflo-agentdb + ruflo-knowledge-graph — G7 controllers

plugins/ruflo-aidefence/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-aidefence",
   "description": "AI safety scanning, PII detection, prompt injection defense, and adaptive threat learning",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"

plugins/ruflo-aidefence/README.md

@@ -16,6 +16,14 @@ AI safety scanning, PII detection, prompt injection defense, and adaptive threat
 - **Adaptive learning**: Train defenses on confirmed threats to improve detection
 - **Threat classification**: Categorize threats with confidence scores
 
+## Defense-in-depth pairing (ruflo 3.6.25+)
+
+This plugin pairs with three runtime hardening features that ship in the host (ADR-095 / ADR-096 / audit_1776853149979):
+
+- **Loader-hijack denylist** — `validateEnv()` rejects `LD_PRELOAD`, `LD_LIBRARY_PATH`, `LD_AUDIT`, `DYLD_INSERT_LIBRARIES`, `DYLD_LIBRARY_PATH`, `DYLD_FALLBACK_LIBRARY_PATH`, `DYLD_FORCE_FLAT_NAMESPACE`, `NODE_OPTIONS`, `NODE_PATH` at the `terminal_create` MCP boundary. Adding any of these to a child process is functionally RCE; threat scoring should treat a denylist-enforcing host as substantially less exposed.
+- **File mode 0600 / dir mode 0700** on session, terminal, and memory stores via `fs-secure.writeFileRestricted` — cross-user-on-host reads blocked at the OS layer.
+- **Encryption at rest** (opt-in via `CLAUDE_FLOW_ENCRYPT_AT_REST=1`) — AES-256-GCM with magic-byte (`RFE1`) backward-compat sniff. Reports involving memory.db / sessions / terminal-history exfiltration should account for the gate state (`ruflo doctor -c encryption`).
+
 ## Commands
 
 - `/aidefence` -- Detection stats and threat analysis dashboard

plugins/ruflo-security-audit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-security-audit",
   "description": "Security review, dependency scanning, policy gates, and CVE monitoring",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"

plugins/ruflo-security-audit/README.md

@@ -18,6 +18,19 @@ Security review, dependency scanning, policy gates, and CVE monitoring.
 - **Policy Gates**: Configurable security policies for CI/CD pipelines
 - **Threat Modeling**: Automated threat analysis and risk assessment
 
+## Patterns to scan for (audit_1776853149979 follow-up)
+
+The 3.6.25 release closed a class of shell-injection bugs. When auditing downstream code, the scanner should flag these patterns:
+
+- **`execSync(string)` with template-literal args** — replace with `execFileSync(cmd, argv, { shell: false })`. Closed sites: `github-safe.js`, `statusline.js/cjs` (git calls), `mcp-tools/github-tools.ts` (`gh pr/issue/run`), `update/executor.ts` (`npm install`).
+- **Numeric MCP inputs cast as `number`** — TypeScript casts don't run at runtime. A `prNumber: "1; rm -rf /"` slips through. Mitigate via `toPositiveInt(value)` (see `src/mcp-tools/github-tools.ts`).
+- **Untrusted package specs flowing into `npm install`** — gate via `isSafePackageSpec(pkg, version)` regex check (see `src/update/executor.ts`). Defense-in-depth even with `execFileSync`.
+- **Loader-hijack env vars** (`LD_PRELOAD`, `NODE_OPTIONS`, `DYLD_*`) flowing into a child process env — gate via `validateEnv()` (see `src/mcp-tools/validate-input.ts`).
+- **Plaintext secrets at rest** in `.claude-flow/sessions/`, `.claude-flow/terminals/store.json`, `.swarm/memory.db` — paired with [ADR-096](../../v3/docs/adr/ADR-096-encryption-at-rest.md) opt-in encryption (`CLAUDE_FLOW_ENCRYPT_AT_REST=1`). Confirm gate state via `ruflo doctor -c encryption`.
+- **MCP stdin DoS** — un-newlined input piped into the MCP server. The host caps the buffer at 10MB by default; downstream MCP wrappers should enforce equivalent limits.
+
+A `ruflo verify` round-trip confirms 55 witnesses (27 regression-fix + 28 per-source-file capability) match the signed manifest byte-for-byte.
+
 ## Requires
 
 - `ruflo-core` plugin (provides MCP server)